PHP Foundation says critical flaw found in 2024, fix delay was 'structural failure'

The PHP Foundation said the root cause of two critical vulnerabilities was exposed in an external security audit as early as 2024, and that the delayed fix was a 'structural failure' due to compatibility, performance and ecosystem trade-offs, plus hesitant security-team decisions and insufficient resources.

Detected & updated continuously · Source: Nebula