PHP Foundation Cuts Release Timeline By 24 Hours After Two 9.2 Flaws Leak
A Hacker News post detailing critical runtime bugs forced the organization to move its coordinated disclosure forward, while Chainguard admitted to breaking the silence rule.
By Yuna Fletcher ·
The PHP Foundation advanced its scheduled release by one day on October 23 after details of two critical security flaws became public too soon. The organization originally planned a controlled disclosure to allow developers time to patch affected systems, but early leaks compressed the available window for action.
The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, are remote code execution bugs within the PHP runtime. Both carry a severity rating of 9.2, placing them in the high-risk category that demands immediate attention from server administrators.
A user on Hacker News named petecooper posted details of the flaws before the embargo lifted. In a public statement, petecooper apologized for the timing, noting that they believed the information was urgent given PHP's standard four-week release cycle. They described themselves as a self-employed consultant and the founder of a mental health non-profit, stating they had no formal ties to the involved organizations.
"I appreciate this has had considerable knock-on effects with the schedule for co-ordinated disclosure, and created additional workload," petecooper wrote. "I am truly sorry. I take full responsibility for my actions." The user added that their contact had told them no embargo existed, a claim that contact's source also made.
Petecooper was not the only source of early information. Several posts circulated on social media platforms prior to the official announcement. Additionally, the foundation stated that Chainguard broke the embargo by more than six hours. Dan Lorenc, co-founder and CEO of Chainguard, defended the move on LinkedIn, explaining that he spoke with other researchers before deciding to notify the public group rather than just his customers once the fix was available.
The bugs in the PHP runtime were discovered using artificial intelligence tools, not through attacks by rogue AI systems. The use of these tools allows researchers to identify weaknesses in widely used code that may have existed for years or decades. This capability creates a faster cycle for finding and fixing vulnerabilities, turning each discovery into a race between developers and potential exploiters.
Source: Tom's Hardware
