PHP Foundation moves patch release up a day
Early leaks of two critical flaws forced the organization to accelerate its scheduled disclosure.
By Alina Carter ·
The PHP Foundation advanced its critical patch release by 24 hours after details of two high-severity vulnerabilities leaked before the coordinated disclosure window closed.
A user on Hacker News identified as petecooper posted the CVE identifiers ahead of the embargo. The user stated they shared the information to alert those following PHP's four-week release cycle that the issue was urgent. They described themselves as a self-employed consultant and the founder of a mental health non-profit, noting they had no formal ties to the involved organizations. Petecooper apologized for the disruption, writing, "I take full responsibility for my actions." They added that their contact had initially claimed no embargo existed, a detail the contact's own source had also provided.
The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, carry a severity rating of 9.2. They are remote code execution bugs located within the PHP runtime. The foundation had planned a controlled release to allow time for patches to be deployed before widespread knowledge of the defects.
Leakage began when some recipients of the advance warning did not forward the embargo conditions. Word spread on social media and other platforms faster than intended. The foundation determined that Chainguard broke the silence more than six hours before the scheduled time. Dan Lorenc, CEO of Chainguard, defended the move on LinkedIn. He said he consulted with other researchers before acting. He also stated he notified the wider group once the fix became public, rather than limiting alerts to company customers.
Researchers discovered these specific bugs using AI tools. The flaws were not caused by rogue AI systems. However, the use of such tools can help both defenders and attackers find vulnerabilities in widely used code that may have existed for years or decades. Each discovery creates a race to deploy fixes before exploitation occurs.
The PHP Foundation shifted the announcement date to October 24, 2026. This change allows for immediate public access to the patches following the early disclosures.
