The PHP Foundation, which coordinated fixes for two critical PHP flaws, operates on a shoestring budget with one full-time staff member and 14 contractors

Your website is now safer from remote code execution because a critical PHP vulnerability has been patched.

Hackers attempted to exploit critical vulnerabilities in the PHP programming language just days before patches were released. Amazon Threat Intelligence detected exploit attempts on October 17th and again on October 21st, shortly before websites were urged to update their systems. The vulnerabilities, CVE-2026-109618 and CVE-2026-109619, could allow for remote code execution. While the PHP Foundation's executive director stated there were no known successful remote code executions, they emphasized the necessity of updating. The fix for these flaws was delayed due to the complexity of coordinating compatibility changes across numerous extensions and potential security trade-offs. The PHP Foundation has acknowledged the need to expedite the resolution process for similarly complex vulnerabilities in the future.

The PHP Foundation's struggle to coordinate a timely fix highlights the significant challenges in maintaining foundational open-source software with limited resources. Operating with a single full-time employee and 14 contractors, the organization's shoestring budget underscores a broader industry reliance on underfunded open-source projects that power a substantial portion of the internet.

This incident signals a critical need for increased investment and better coordination mechanisms for essential open-source infrastructure. The near-miss exploitation suggests that the current pace of vulnerability patching may not be sufficient to counter sophisticated threat actors, potentially leaving many web applications exposed.