Commit

The PHP ecosystem had a pretty eventful 48 hours. Two critical RCE vulnerabilities (CVSS 9.2), a leaked disclosure, and emergency security patches. But here's what really caught my attention: one of the issues had surfaced during an external audit in 2024. The PHP Foundation later described the delay in resolving it as a “structural failure.” The good part? They're looking at changes to security decision-making and investing more in security work. Open source isn't maintained by magic. It takes people, time and funding, especially for the unglamorous work of keeping things secure. If you run PHP in production, check your runtime and apply the appropriate security update. Updating Composer dependencies alone won't patch PHP itself. Hopefully, this incident leaves the PHP ecosystem stronger than before. ❤️