PHP Foundation ships patches a day early after leaks
Two critical runtime flaws were exposed ahead of schedule, forcing the foundation to move its October 24 release up by 24 hours.
By Thiago Kovalenko ·
The PHP Foundation moved its critical security patch release forward by one day after details of two severe flaws leaked early. The foundation originally planned a coordinated disclosure for October 24, 2026, but shifted the date to October 23 to limit exposure time. The decision followed multiple independent reports that broke the silence surrounding the vulnerabilities.
The two bugs, identified as CVE-2026-109618 and CVE-2026-109619, carry a severity rating of 9.2. They are remote code execution flaws located in the PHP runtime core. Because the runtime is embedded in many web applications, the bugs allow attackers to potentially take control of servers. The foundation intended to give developers and system administrators a window to apply fixes before the issues became public knowledge. The early leak compressed that window by a full day.
A user on the platform Hacker News, known by the handle petecooper, posted the CVE details before the embargo lifted. In a public statement, petecooper apologized for the disruption. They said they shared the information to warn followers of PHP's release cycle about the urgency of the matter. Petecooper described themselves as a self-employed consultant and the founder of a mental health non-profit, stating they had no formal ties to the involved organizations. They claimed a contact told them no embargo existed, a detail that contact's source had also confirmed.
Petecooper acknowledged the impact on the disclosure schedule. "I appreciate this has had considerable knock-on effects with the schedule for co-ordinated disclosure, and created additional workload," they wrote. "I am truly sorry. I take full responsibility for my actions." The user added that unintended side effects were not their goal when posting the technical details.
Other parties also contributed to the early exposure. The foundation noted that several recipients of the advance warning did not pass along the embargo terms. Additionally, the security firm Chainguard broke the embargo by more than six hours. Dan Lorenc, co-founder and CEO of Chainguard, defended the move on LinkedIn. He stated he acted after consulting with other researchers. Lorenc said he notified the broader group immediately after the fix went public, rather than limiting the alert to Chainguard customers.
The bugs were discovered using AI tools, not through attacks by rogue AI systems. The finding highlights how these tools can uncover vulnerabilities in widely used code that may have existed for years. This capability creates a race between researchers and malicious actors. Each discovery demands a rapid development and deployment cycle for fixes to prevent exploitation before patches reach all users.
