PHP Foundation Ships Critical Fixes 24 Hours Early After Early Leaks

The PHP Foundation released security patches for two critical vulnerabilities one day earlier than planned, moving the public disclosure to October 24. This acceleration followed the early leakage of details for two flaws rated 9.2 in severity, which threatened the coordinated timing of the update.

The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, are remote code execution bugs located in the PHP runtime. The foundation had initially scheduled a controlled release to allow affected websites and applications time to apply fixes before the flaws became widely known. The early leak disrupted this strategy.

A user on Hacker News with the handle petecooper posted details of the vulnerabilities before the embargo ended. In a public statement, petecooper apologized for the timing and said they had no idea a restriction existed. They described themselves as a self-employed consultant and the founder of a mental health non-profit, noting they had no affiliation with the organizations involved. They stated they shared the CVEs to warn others that the issue was urgent.

"I take full responsibility for my actions," petecooper wrote. They added that their contact had said there was no embargo, a claim that contact's source had also made. The user said causing additional workload for the disclosure process was not their intention.

Chainguard also broke the embargo, doing so more than six hours before the scheduled time. Dan Lorenc, co-founder and CEO of Chainguard, defended the company's decision on LinkedIn. He said he acted after speaking with other researchers. Once the fix was publicly available, Lorenc said he notified the entire group rather than limiting the alert to Chainguard's customers.

Researchers discovered the bugs using AI tools. The flaws were not the result of attacks by rogue AI systems, but the use of such tools allows both security researchers and malicious actors to find vulnerabilities in widely used code. This dynamic turns each discovery into a race to deploy a fix before the flaw can be exploited.

The PHP Foundation's decision to move the announcement forward by one day responds to leaks that had already circulated on social media and other platforms. The foundation aims to ensure that developers and system administrators have access to the necessary patches as quickly as possible.