Early leak of critical PHP bugs forces security team to speed up patch release
A community member admitted to sharing details of two severe vulnerabilities before the official deadline, contributing to a chaotic disclosure timeline for the PHP Foundation.
By Eduardo Salazar ·
The planned coordinated release of fixes for two severe security flaws in the PHP engine was disrupted by early public leaks of the vulnerability details. The PHP Foundation moved its official announcement forward by one day to manage the situation. This accelerated timeline was a direct response to information spreading through online channels before the intended embargo period concluded. The incident highlights the ongoing difficulty in managing the timing of critical software security disclosures in a highly connected digital environment.
The two specific issues in question are tracked as CVE-2026-109618 and CVE-2026-109619. Both are classified as remote code execution vulnerabilities with a severity score of 9.2. These bugs exist within the core PHP runtime rather than in third-party extensions. Their high severity rating indicates that successful exploitation could allow an attacker to execute arbitrary code on a server. The rapid identification of these flaws underscores the evolving landscape of software security testing.
A user on the Hacker News platform, operating under the handle petecooper, posted detailed information about the vulnerabilities before the agreed-upon disclosure date. In a public statement, the user apologized for the timing and acknowledged the impact on the release schedule. They stated that they shared the information to alert others who follow the standard four-week PHP release cycle. The user described themselves as a self-employed consultant and the solo founder of a mental health non-profit, noting they had no formal affiliation with the organizations involved in the disclosure.
Petecooper expressed regret for the additional workload and scheduling changes caused by their post. They wrote, "I appreciate this has had considerable knock-on effects with the schedule for co-ordinated disclosure, and created additional workload. I am truly sorry. I take full responsibility for my actions." The user explained that they believed no embargo was in place based on information from a contact. They added that their contact had claimed there was no restriction, a statement that the contact's own source had also made.
The PHP Foundation had intended a controlled public release to give affected websites and applications sufficient time to apply patches. The goal was to prevent the flaws from becoming widely known before defenses were in place. However, some recipients of the advance warning did not pass along the embargo requirements. This failure to communicate the restrictions allowed the details to circulate sooner than planned. The foundation noted that these early leaks created a sense of urgency that altered their original communication strategy.
Petecooper was not the only source of early information. Several leaks had already been circulating on social media and other platforms before the official statement. These multiple sources of early disclosure pushed the PHP Foundation to bring its announcement forward by one day. The foundation also identified Chainguard as having broken the embargo by more than six hours. This timeline compression required all parties to adjust their public communications rapidly to maintain clarity for users.
Dan Lorenc, co-founder and CEO of Chainguard, defended the company's decision to share the information early. He explained the action on LinkedIn, stating he acted after speaking with several other researchers. Lorenc said that once the fix was released publicly, he chose to notify the broader group rather than limiting the announcement to the company's customers. This approach reflected a preference for transparency within the security research community during a period of heightened activity.
The two flaws were discovered using artificial intelligence tools, although they were not the result of attacks by rogue AI systems. The use of AI in finding these bugs illustrates how such tools can help both security researchers and malicious actors uncover vulnerabilities in widely used code. These vulnerabilities may have existed for years or even decades before detection. Each discovery now creates a race to develop and deploy a fix before the flaw can be exploited in the wild. This dynamic increases the pressure on developers and users to stay current with security updates.
Source: Tom's Hardware
