The PHP Foundation says the delayed response to a critical PHP vulnerability was the result of “indecision” and a shortage of resources, calling the stalled fix a “structural failure.” The acknowledgment comes as government agencies and other organizations took websites offline while PHP issued emergency patches for two related critical security issues affecting widely used server software.