Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?

Risks / R08 Frontier AI finds critical flaws faster than maintainers can fix them / R08-1

R08-1: A known bug left unexploited, then unfixed, for two years

Because a 2024 audit found the out-of-memory issue but not its exploitation, and two findings were redacted while their fixes were in progress, the bug waited until better tools showed it could be weaponised, resulting in a fix shipped under emergency instead of on the maintainers' schedule.

Rating 16 high · Likelihood 4 Likely · Impact 4 Major · Kind Strategic · Acceptance not recorded

Basis. Confirmed audit; redaction reported.

The path

Told inphp2shell in perspectivephp2shell in perspec…Acted on byCISOCISOHistorianHistorianCarried byThe PHP project (owner)The PHP project (own…Quarkslab and OSTIF (informer)Quarkslab and OSTIF …The PHP Foundation (treater)The PHP Foundation (…RiskR08-1 A known bug left unexploited, then unfixed, for two yearsR08-1 A known bug le…Arises fromA small, thinly funded maintainer team at the base of the webA small, thinly fund…The allocator's longjmp-based bailout on out-of-memoryThe allocator's long…VulnerabilityCVE-2026-109618CVE-2026-109618CVE-2026-109619CVE-2026-109619Fixed byA soft memory limit that no longer jumpsA soft memory limit …A hard limit that ends the process cleanlyA hard limit that en…An orderly unwind at the next safe pointAn orderly unwind at…Allocations that may fail instead of abortAllocations that may…Request globals reset so nothing survives a failureRequest globals rese…Bounded, deduplicated request parsingBounded, deduplicate…CodeZend/zend_alloc.cZend/zend_alloc.cZend/zend_execute_API.cZend/zend_execute_AP…Zend/zend_hash.cZend/zend_hash.cZend/zend_string.cZend/zend_string.cZend/zend_types.hZend/zend_types.hext/session/session.cext/session/session.…main/SAPI.cmain/SAPI.cmain/main.cmain/main.cmain/rfc1867.cmain/rfc1867.c
The risk sits in the middle. To its left, the stories that tell it, the roles and team members that act on it, and every stakeholder that carries part of it. To its right, what it arises from, the vulnerability behind that, the part of the fix that addresses it and the code the fix changed. Every line is an edge in the graph; every node is a link; hover for the full name. Vulnerabilities, stories and team members include those of the risk this one is part of; roles include those of the risks above and beneath it.

Who carries it

One risk, assigned to every stakeholder that carries part of it, with the part each plays.

StakeholderPartWhyIts register
The PHP projectownerTriage of audit findings.11 risks
Quarkslab and OSTIFinformerThe audit.1 risk
The PHP FoundationtreaterFunds the developers who would fix it.3 risks

What it arises from

The evidence

ClaimStatusFact-checkSources
The out-of-memory issue was found in a 2024 audit by Quarkslab (funded through OSTIF and the Sovereign Tech Agency) but exploitation was not proven, so it was not fixedconfirmedA2 ReportedPHP Foundation Calif
Quarkslab's published audit summary lists 27 findings, two redacted because their fixes were complex and in progress; it does not describe an out-of-memory findingreportedA6 EstablishedQuarkslab David Lopez-Kurtz

Treatments

TreatmentStatusWhere
Publicly funded audits (OSTIF, Sovereign Tech Agency)partialWho found php2shell, and what the AI did

The standards that govern it

FrameworkControlWhat it asksFamily
NIST SSDFPW.7Review and analyse human-readable code to find vulnerabilitiesFrameworks and control catalogues
NIST SSDFRV.2Assess, prioritise and remediate vulnerabilitiesFrameworks and control catalogues
Cyber Resilience ActArt.24Obligations of open-source software stewardsLaw and regulation
ISO/IEC 27001A.8.25Secure development life cycleManagement-system standards

The stories that tell it

On this site: Who found php2shell, and what the AI did