Post Syndicated from corbet original https://lwn.net/Articles/1102060/

The PHP Foundation has put out a
blog entry explaining how the vulnerabilities disclosed today came
about and why they took so long to fix.

To fix the OOM problem, the PHP security team developed several
competing approaches, but each came with its own trade-offs:
backward compatibility breaks, new denial-of-service potential, or
requiring changes to many third-party extensions which seemed
impossible to coordinate. The PHP security team, operating on
consensus, struggled to choose between these and feared the
repercussions of shipping the wrong choice. Combined with the lack
of a known path to remote code execution and the small team of core
developers with the necessary deep knowledge of the engine occupied
with many responsibilities, this decision process caused work on a
fix to stall and restart repeatedly over months. We won’t pretend
otherwise: the delay was a structural failure, caused by both the
security team’s decision process and its lack of resources.