Several researchers reported that the patch released by PHP yesterday is incomplete. According to PHP, there is no third vulnerability.
A double vulnerability in the popular programming language PHP set the global internet on fire yesterday. Maintainer PHP Foundation released an emergency patch against the clock, and judging by the lack of news reports about exploits, the majority of web administrators seem to have done their homework. Yet some independent researchers are questioning the patch.
Researcher Nicolas Krassas says on X that the patch still leaves an attack route open. This specifically concerns version 8.5.12. That same update is also being put in the crosshairs by another researcher, Elise Boyd. There is reportedly another memory bug in PHP 8.5.12 that the patch does not resolve.
PHP: ‘no third vulnerability’
PHP says there is no mention of a third vulnerability. The vulnerability Boyd refers to is reportedly unrelated to the leaks patched by the PHP Foundation, a developer says via Reddit. Now that PHP is under the magnifying glass, it cannot be ruled out that more reports of vulnerabilities in the programming language will surface in the coming period. These do not necessarily all have the same level of severity.
AI is both the friend and foe of code maintainers here. With AI, vulnerabilities can be detected faster. However, not every vulnerability report generated by AI is equally reliable or urgent, making it difficult for human maintainers to respond to every notification.
The PHP Foundation is facing criticism for how it handled the vulnerabilities, as it had been aware of at least one since 2024 but had not patched it. The foundation is hitting back and is not happy with security researchers who do not share their findings in consultation. This created a dangerous gap yesterday between the disclosure of the vulnerability and the release of the patch. Nowadays, attackers only need a few hours to devise an exploit.
Releasing a patch is only the beginning of a safer internet. Web administrators must now also implement the patch, and that is often where things go wrong in practice. In the coming days, hackers will still be eagerly searching for unpatched backdoors.