Update: PHP Foundation Says a 2024 Audit Found the First Signs of the Flaw In the same post, the PHP Foundation said a core developer first found signs of the out-of-memory flaw behind CVE-2026-109618 during PHP's 2024 external audit, but a working attack was only theorized and no concrete route to code execution was found then. Competing fixes each risked breaking compatibility, opening denial-of-service paths, or forcing changes on third-party extensions, and a small team struggled to agree, so work on a fix stalled for months. The Foundation called the delay "a structural failure" of its decision process and its resources.

The 2026 reports from Calif, OpenAI and Wiz, which used AI tools, established the working exploit that made the flaw's full impact clear and moved the fix to the top of the queue. The Foundation said it has since changed how it makes security decisions and added staff and tooling to catch similar problems sooner.