The PHP Foundation has given an unusually frank account of the emergency behind this week’s patches. It said it had found one of the two critical flaws two years ago, in 2024. Then it spent months unable to agree on how to repair it.

The admission came in a blog post from the Foundation on Wednesday. It landed hours after the fix for the two critical PHP flaws known together as PHP2Shell. Both bugs sit in the parts of PHP that almost every request touches: memory management and error handling. That central place made them serious, the Foundation said, and hard to fix without breaking the wider ecosystem.

A core developer first spotted the memory-handling bug in 2024. It surfaced while the team fixed a separate issue from PHP’s first external security audit. Someone theorised a possible exploit at the time. But no one found a concrete way in, and clearer problems took priority.

Then the fix stalled. The security team drew up several competing repairs, the Foundation said. Each carried a cost.…