PHP Foundation accelerates patch release after early leak of two critical flaws

The PHP Foundation moved its public announcement of two critical security flaws forward by one day after details leaked online ahead of the scheduled disclosure date. The shift means that developers and site administrators now have one fewer day of the originally planned quiet period to install updates before the vulnerabilities become widely known.

A user on the Hacker News platform, who goes by the handle petecooper, posted the Common Vulnerabilities and Exposures (CVEs) for the bugs on the evening of the leak. The two flaws, identified as CVE-2026-109618 and CVE-2026-109619, are remote code execution bugs in the PHP runtime itself. Both are rated 9.2 on the severity scale, which places them in the critical category.

In a public statement, petecooper apologized for the timing and explained that they shared the information to warn users of the importance of the update. The consultant said they believed the bugs were urgent and had no idea a disclosure embargo was in place. They noted that their direct contact had stated there was no restriction on sharing the details, a claim that contact’s source had also made.

The foundation stated that the early leaks created additional workload for the coordinated disclosure process. While petecooper’s post was a major source of the information, it was not the only leak. Several other reports had already circulated on social media and other platforms, which contributed to the decision to accelerate the timeline. The foundation also identified Chainguard as having broken the embargo by more than six hours.

Dan Lorenc, co-founder and CEO of Chainguard, defended his company’s actions on LinkedIn. He said he made the decision to disclose the fix after speaking with several other researchers. Lorenc explained that once the patch was released publicly, he notified the broader research group rather than limiting the alert to Chainguard’s customers.

The bugs were discovered using AI tools rather than through attacks by rogue artificial intelligence systems. The use of such tools allows security researchers to uncover vulnerabilities that may have existed in widely used code for years. This capability also allows malicious actors to find similar flaws, turning each discovery into a race to deploy fixes before the bugs can be exploited.

Petecooper described themselves as a self-employed consultant and the founder of a mental health non-profit. They said they took full responsibility for the actions and expressed regret for the knock-on effects on the disclosure schedule.