PHP Foundation admits structural failure delayed critical security fix for 2024 vulnerability

The PHP Foundation acknowledged that indecision and resource shortages led to a "structural failure" delaying a fix for a critical security flaw first identified in 2024. Emergency patches were released for two related vulnerabilities, which could allow unauthenticated attackers to execute code on affected servers. Global organizations, including government agencies in the Netherlands, Finland, France, Germany, and Australia, took websites offline as a precaution, and the Wikimedia Foundation temporarily suspended some services.