PHP Podcast – October 22, 2026

Hosts: Holly, Sara, Joe – Special Guest Daniel Scherzer

PHP ships an emergency security release a day early, Daniel Scherzer pushes the commits at 6:30am on four hours of sleep, and governments across Europe start pulling servers offline. Oh, and a 12-pound dog nearly killed Holly.

The PHP2Shell Security Release
Special guest Daniel Scherzer — release manager for PHP 8.5 and 8.6 and a recent addition to the PHP ecosystem security team — walked the crew through the week’s big story: two critical CVEs that could lead to remote code execution. The team coordinated a synchronized release across PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12, with additional source backports provided for 7.4, 8.0, and 8.1 given how severe the vulnerabilities were.

Daniel described the stress of it all, including waking up at 1am with a headache before a 5am alarm and a release process planned for 1300 UTC. In the end he volunteered to push every change himself, running three commands to push a whole bunch of commits across three repositories in a single atomic operation — four tags and seven branches at 1335 UTC, just before public disclosure.

He also drew a clear line around the hats he wears. As a release manager he had early access to the fix, but he deliberately did not patch his own PHP-powered website ahead of time, explaining that the community trusted him to help release PHP, not because he was important enough to get early access for personal use. Governments in Europe were turning off public-facing sites and the NSA published guidance, leaving Daniel marveling at how he ended up with a front-row seat to something heads of government were paying attention to.

A Two-Year-Old Bug and the AI Angle
The vulnerability wasn’t new — it was originally discovered back in 2024 during the security audit funded through the PHP Foundation via the German government’s Sovereign Tech grant. The bug reportedly traces back through the PHP 5 series and possibly even PHP 4. What changed in 2026 was that someone (with AI tooling assistance) figured out how to turn a theoretical vulnerability into a workable exploit.

Daniel pushed back on the framing that AI simply “found” the bug, emphasizing the two years in between where it was known but there weren’t enough maintainer hours or infrastructure to address it. At the time it was essentially a theoretical bug with no consistently provable exploit path. He cautioned that AI-discovered vulnerabilities shouldn’t be assumed correct without a human reviewing them, noting he hadn’t yet seen a clean proof-of-concept that didn’t also rely on some other underlying server vulnerability.

The group discussed the rate of security reports skyrocketing as LLMs become common, with Sara describing the bandwidth problem the volunteer security team faces: triaging what’s likely to be exploited, confirming fixes are actually complete, and avoiding publishing an incomplete fix that tips off bad actors. Amazon claimed to have seen exploitation attempts beforehand, but the release manager chat showed no indication the bug was ever exploited in the wild before the release.

Fund the Volunteers Who Hold Up the Internet
A recurring theme was that PHP is fundamentally a volunteer-driven effort. The packagers for Ubuntu, Debian, and Red Hat — Remy and Andres — were both on vacation and stopped their plans to package PHP a day early. The Docker library maintainers are volunteers too, as are many members of the Foundation security team who are still not paid contractors.

The crew highlighted a Mastodon post from Nils Alderman arguing that if the governments shutting down servers, the hosting companies, and the enterprises terrified by this vulnerability each gave even $50,000 a year to the PHP Foundation, things could look very different. Daniel echoed this: had there been infinite money and maintainer hours, every theoretical vulnerability might get fixed as a hardening measure.

Joe shared how PHP Architect Consulting had its first client patched roughly 30 minutes after the fix went live — thanks to a tip from Marco Pavetta about forking the Docker PHP library repo and building your own base image before the mirrors saturated. He also recounted his own role helping Derick Rethans keep php.net patched before the announcement so the site wouldn’t fall over under load, including one odd bug where the patched version broke Apache directory listing on downloads.php.net.

Life as a Release Manager
With three release managers now on the team — Daniel, Joe, and Matteo Beccati — the conversation turned to what the role actually involves. Joe explained he wanted to learn more about the process, especially how to make judgment calls on backwards-compatibility breaks, and that lots of discussion happens behind the scenes before and during a release. Daniel noted he’d volunteered to be 8.5’s release manager for this exact week over a year ago, and that the Zoom coordination call was his idea.

They dug into an ABI change in the security release that added new fields to the executor globals. The group debated whether that counts as an ABI break — the consensus being it technically is one, but a safe one as long as you’re not mixing newer extensions depending on those fields with older versions in the same branch. Sara and Holly stressed that extensions should never be wholesale copying global blocks in the first place, especially given how differently that memory behaves in threaded versus non-threaded builds.

Daniel shared his origin story: just over two years contributing to PHP, starting with a typo fix to a test name after creating a professional GitHub account under Daniel E. Scherzer. Holly and Sara warned him there’s no escaping — Sara sent her first patch 24 years ago and is still here. The bit about “settling for Joe” ran throughout the whole episode.

Rust, C, and the Rewrite Temptation
Daniel raised the question of rewriting PHP in Rust, pointing out the vulnerability was fundamentally tied to C’s longjmp, which doesn’t exist in Rust. Sara countered that you don’t need a longjmp approach at all — the same behavior could be achieved with C++ exceptions or a Rust mechanism, but it would be a fundamentally different runtime approach.

Holly, half-joking, said she’s one sponsor away from pulling a “bun” and throwing hundreds of thousands of AI agents at a hard rewrite of the PHP engine, predicting this is the first of many memory-safety bugs AI agents will surface in the C codebase. Daniel tempered the hype, noting AIs hallucinate and that this being the first of 100,000 reports doesn’t mean there are 100,000 real memory issues.

The segment wrapped with Daniel’s recent work building PHP extensions in Rust (he gave a workshop on it at Longhorn), digging into the C macros for globals and how ZTS thread-support mode changes everything. The repeated advice: learn it, experiment on your own fork, but don’t mess with it until you actually understand it — and never hit git push to the public source.

Links from the show:

PHP Tek 2027 — April 27–29 in Chicago, early bird tickets available
PHP Tek CFP — closes end of October 2026
Scherzer.dev — Daniel’s site, blog, timeline write-up, and hire info
PHP Foundation — donate to support PHP security work
https://phpc.social/@naderman/117485091076355564
Today’s PHP Security Release, and How We’re Strengthening PHP Security

Host:

Streams:

- Youtube Channel
- Twitch

Connect & Hire

Looking to hire PHP developers? Email support@phparch.com – Joe and the team are available for consulting, infrastructure work, Ansible playbooks, and code review.

Partner

This podcast is made a little better thanks to our partners

OurCVEs

Your security posture, on autopilot with OurCVEs

CodeRabbit
CodeRabbit - cut code review time & bugs in half Instantly.

Cut code review time & bugs in half instantly with CodeRabbit.

PHP Architect Consulting

PHP Architect provides long-term technical partnerships for organizations that need senior-level PHP expertise that you can depend on. Your PHP codebase deserves a partner, not a contractor. Learn more.