The out-of-memory issue was found in a 2024 audit by Quarkslab (funded through OSTIF and the Sovereign Tech Agency) but exploitation was not proven, so it was not fixed

Fact-check

A2 Reported●●○○○○ disputed status overstated · Attribution · verdict: holds in part · the status word overstates the evidence

Calif says Quarkslab's audit 'rediscovered the same OOM issue' and 'exploitation was not proven, hence the bug was not fixed', but Calif says it confirmed this 'from PHP', so it is not independent of the Foundation. The Foundation says something different: a PHP core developer found the OOM signs while fixing a Quarkslab finding, and the fix stalled over trade-offs and resources, not only unproven exploitation. Quarkslab's own summary describes no OOM finding.

Open tickets: Finding-5, Finding-6, Finding-94.

Graded in Run-1, resting on captures up to 2026-10-22 11:30 UTC. The scale is on the fact-check page.

This fact over time

1. 2026-10-21PHP Foundation publishes Today's PHP Security Release, and How We're Strengthening PHP Security
2. 2026-10-21Calif publishes php2shell by Calif Research — A tale of two PHP remote vulnerabilities
3. 2026-10-22 08:09 UTCSaved into the evidence vault: PHP Foundation
4. 2026-10-22 08:10 UTCSaved into the evidence vault: Calif
5. 2026-10-22Enters this site as confirmed in v0.1.0 (reconstructed from git)

Published: when the source says it was published. Saved: the first capture into the evidence vault. The rest are this site: the release in which the fact first appeared and every release that changed its wording, sources or status.

What it rests on

Where this fact appears

In the briefings for:

And on every claim.

Every version of this fact

The out-of-memory issue was found in a 2024 audit by Quarkslab (funded through OSTIF and the Sovereign Tech Agency) but exploitation was not proven, so it was not fixed
Who says it: PHP Foundation; Calif
Status: confirmed
Topic: discovery
Sources: php-foundation-blog-security-release, calif-php2shell