Today's PHP Security Release, and How We're Strengthening PHP Security (PHP Foundation)

The PHP Foundation has put out ablog entry explaining how the vulnerabilities disclosed today cameabout and why they took so long to fix.

To fix the OOM problem, the PHP security team developed severalcompeting approaches, but each came with its own trade-offs:backward compatibility breaks, new denial-of-service potential, orrequiring changes to many third-party extensions which seemedimpossible to coordinate. The PHP security team, operating onconsensus, struggled to choose between these and feared therepercussions of shipping the wrong choice. Combined with the lackof a known path to remote code execution and the small team of coredevelopers with the necessary deep knowledge of the engine occupiedwith many responsibilities, this decision process caused work on afix to stall and restart repeatedly over months. We won't pretendotherwise: the delay was a structural failure, caused by both thesecurity team's decision process and its lack of resources.