@thanetric If you read the PHP Foundation's version of events, you'll find that the problem has been known about for years, but not considered a problem because exploiting the flaw is, and remains, extremely difficult.

An attacker would need to send several carefully crafted requests, to a server which doesn't use standard memory allocation protections, and without any other process writing to the target memory in between.

The problem of memory allocation and freeing is quite common in C programs in general, not just the PHP interpreter.