Leaked PHP Flaws Force Foundation to Accelerate Patch Release
Early disclosures of two 9.2 severity vulnerabilities compressed the timeline for a critical update to the PHP runtime.
By Kenji Hassan ·
The PHP Foundation moved its planned security release forward by 24 hours on October 23 after details of two critical vulnerabilities surfaced ahead of the scheduled embargo. The early disclosure disrupted the controlled rollout designed to give developers time to apply fixes before the flaws became public knowledge.
The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, carry a severity rating of 9.2. They represent remote code execution bugs within the PHP runtime itself. The foundation had intended to coordinate the announcement to allow affected websites and applications to patch their systems in a managed window.
User petecooper, a self-employed consultant and founder of a mental health non-profit, posted details of the flaws to Hacker News. In a public statement, petecooper apologized for the timing, noting they believed the release was urgent for those following PHP's four-week cycle. "I appreciate this has had considerable knock-on effects with the schedule for co-ordinated disclosure, and created additional workload. I am truly sorry. I take full responsibility for my actions," petecooper wrote. They stated that a contact had claimed no embargo existed, a claim that contact's own source had also made.
Petecooper was not the only source of early information. Other recipients of the advance warning shared details on social media and other platforms. The foundation also noted that Chainguard broke the embargo by more than six hours. Dan Lorenc, co-founder and CEO of Chainguard, defended the move on LinkedIn. He said he acted after consulting with other researchers and that he notified the broader group immediately once the fix was publicly available.
The two flaws were discovered using AI tools rather than through attacks by rogue artificial intelligence. The use of such tools allows researchers and malicious actors to find vulnerabilities that may have existed in widely used code for years. Each discovery creates a race to develop and deploy a fix before the flaw is exploited.
The PHP Foundation is now releasing the patches on October 24. This date is one day earlier than the originally planned disclosure schedule.
Source: Tom's Hardware
