PHP Foundation Moves Patch Release Up After Early Vulnerability Leaks

The PHP Foundation advanced the public release date of security patches by one day after details of two critical vulnerabilities leaked before a planned embargo ended. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, allow for remote code execution in the PHP runtime and carry a severity score of 9.2.

The schedule change followed a post on Hacker News by a user identified as petecooper, who shared the vulnerability details before the disclosure window opened. In a public apology, petecooper stated they believed the information was urgent and had no prior knowledge of a disclosure restriction. The user described themselves as a self-employed consultant and the founder of a mental health non-profit, noting they had no affiliation with the organizations involved in the disclosure process.

Petecooper acknowledged that the post created additional workload and disrupted the coordinated disclosure schedule. "I take full responsibility for my actions," the user wrote, adding that their contact had initially indicated no embargo existed. This claim was later supported by the source of that contact, suggesting the restriction was not clearly communicated to all parties.

The Hacker News post was not the only early leak. Several other disclosures circulated on social media and other platforms, prompting the PHP Foundation to adjust its timeline. The organization also noted that the company Chainguard broke the embargo by more than six hours.

Dan Lorenc, co-founder and CEO of Chainguard, defended his company’s actions on LinkedIn. He explained that he spoke with other researchers before deciding to act. Once the fix became publicly available, Lorenc said he notified the broader research group rather than limiting the announcement to Chainguard’s customers.

The two bugs reside in the core PHP runtime and were identified using artificial intelligence tools. While not caused by rogue AI attacks, the discovery highlights how such tools can uncover vulnerabilities in widely used code that may have persisted for years. This capability creates a race to deploy fixes before malicious actors can exploit the flaws.

The PHP Foundation had planned a controlled release to give website and application developers time to apply patches. The early leaks compressed that window, requiring affected parties to act sooner than anticipated to secure their systems against the remote code execution risks.