An Upstream PHP JIT Use-After-Free, and Why Our Default Flipped Twice

Thu, 01 Oct 2026 20:10:00 -0700

In August, ePHPm turned PHP’s tracing JIT on by default in single-site serve mode. Three days later it went back off on every platform, and it’s still off. The reason turned out to be a use-after-free in PHP’s tracing JIT that has nothing to do with ePHPm. Stock php -S with a stock Laravel skeleton dies on it in a couple of requests. The fix is now released upstream. So this seemed like the right time to write up how we got there, and what still has to happen before the default can flip again.

OPcache on Windows: Two Silent Failures

Sat, 29 Aug 2026 16:45:00 -0700

Windows is the platform where ePHPm gets the least traffic and the most surprises. Last week closed out two OPcache bugs that only exist there. Both were quiet in their own way. One killed the server at startup with nothing in our own logs. The other didn’t kill anything. It just ran PHP 8.3 with no opcode cache at all. For three weeks after a fixed SDK was published, every check stayed green.

Opcache on Luther Monson

An Upstream PHP JIT Use-After-Free, and Why Our Default Flipped Twice

OPcache on Windows: Two Silent Failures