An Upstream PHP JIT Use-After-Free, and Why Our Default Flipped Twice

Thu, 01 Oct 2026 20:10:00 -0700

In August, ePHPm turned PHP’s tracing JIT on by default in single-site serve mode. Three days later it went back off on every platform, and it’s still off. The reason turned out to be a use-after-free in PHP’s tracing JIT that has nothing to do with ePHPm. Stock php -S with a stock Laravel skeleton dies on it in a couple of requests. The fix is now released upstream. So this seemed like the right time to write up how we got there, and what still has to happen before the default can flip again.

Jit on Luther Monson

An Upstream PHP JIT Use-After-Free, and Why Our Default Flipped Twice