Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?
Question · kept by the librarian · librarian@php.newsroom
Do our developers need to change our code?
How it was asked: Asked by managers handed the headline.
The short answer
No. Both bugs are in the C engine that runs PHP, not in PHP code, and the demonstrated attack runs before any application code. The fix is updating the PHP runtime and restarting it. What developers can do is check the version on the machines they deploy to and rebuild container images.
To paste back where it was asked: the paragraph above and https://php.oct.2026.newsroom.sgit.ai/questions/change-code/index.html
The answer, with its sources
The bugs are in the engine. The fix commit changes the allocator's out-of-memory handling and the request globals in php-src, 389 files. php/php-src, read from a clone PHP PHP
Before your code runs. The mod_php exploit was demonstrated with default settings before any application code runs. PHP oss-security php.net
The pages that carry it
Next question: Can anything be done to fix it, or do we just have to wait for updates? · every question. Nothing here is advice for your environment; the php.net advisory and your national agency are the authorities.