PHP Security: Early leak forces faster patch release

Website owners and developers now have less time to apply updates for two severe security flaws in PHP. The PHP Foundation moved its public announcement up by one day after details of the vulnerabilities began circulating earlier than planned. This acceleration changes the timeline for anyone running PHP-based applications who needs to patch their systems immediately.

The incident centers on two bugs in the PHP runtime, tracked as CVE-2026-109618 and CVE-2026-109619. Both are rated 9.2 in severity and allow for remote code execution. The foundation had originally scheduled a controlled release to give users a buffer to deploy fixes before the flaws became widely known. However, the embargo failed to hold.

A user on Hacker News, known as petecooper, posted the details of these vulnerabilities before the scheduled disclosure date. In a public apology, petecooper stated they did not know a restriction existed. They described themselves as a self-employed consultant and the founder of a mental health non-profit. Petecooper said they shared the information to warn others following PHP’s four-week release cycle that the issue was urgent. They noted that their contact had claimed there was no embargo, a claim that contact’s source had also made.

Petecooper took full responsibility for the action. They wrote that they appreciated the knock-on effects on the disclosure schedule and the additional workload it created. The user said causing side effects was never their intention. The foundation confirmed that petecooper was not the only source of early information. Other leaks had already spread across social media, which contributed to the decision to bring the announcement forward.

Chainguard, a software company, also broke the embargo by more than six hours. Dan Lorenc, co-founder and CEO of Chainguard, defended the move on LinkedIn. He said he acted after speaking with several other researchers. Lorenc explained that once the fix was released publicly, he notified the broader group rather than just his company's customers to ensure transparency.

The two bugs were discovered using AI tools rather than being exploited by rogue AI systems. These tools help researchers and potential attackers find vulnerabilities that may have existed in widely used code for years. Each discovery creates a race to develop and deploy a fix before the flaw is exploited. The PHP Foundation’s revised timeline reflects the speed at which information can now move in the security sector.

The foundation’s announcement now includes the details of both flaws. Users are advised to check their systems for the specific versions affected by these bugs. The rapid dissemination of the information underscores the difficulty of managing coordinated disclosures in an era where digital tools accelerate both discovery and communication.