PHP Foundation pulls disclosure forward after early leak of two critical bugs

The PHP Foundation accelerated the public release of two critical security flaws by one day after multiple parties shared details before an embargo ended. The early disclosures forced the organization to abandon a controlled rollout strategy that was designed to give developers a window to patch their systems before the bugs became common knowledge.

The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, allow for remote code execution in the PHP runtime. Both carry a severity rating of 9.2. The bugs were identified using artificial intelligence tools rather than being discovered through active attacks by rogue AI systems.

User petecoaper on Hacker News posted details of the flaws ahead of the scheduled disclosure date. In a public statement, petecooper apologized for the timing, noting that they had believed no embargo existed. They described themselves as a self-employed consultant and the solo founder of a mental health non-profit. Petecooper said they shared the information to warn followers of PHP's four-week release cycle that the issues were urgent.

“I appreciate this has had considerable knock-on effects with the schedule for co-ordinated disclosure, and created additional workload. I am truly sorry. I take full responsibility for my actions,” petecooper wrote. They added that causing side effects was not their intention and that their contact had claimed there was no embargo, a statement that contact's own source had also made.

Chainguard also broke the silence before the agreed-upon time. Dan Lorenc, co-founder and CEO of Chainguard, said the company notified a group of researchers after speaking with several of them. Lorenc explained that once the fix was publicly available, he chose to alert the wider community rather than limiting the notification to Chainguard's customers. The foundation stated that Chainguard exceeded the embargo period by more than six hours.

Several other leaks had already circulated on social media prior to the official announcement. These early reports pushed the PHP Foundation to move its announcement forward by a single day. The organization had originally planned to hold the release until the end of the planned disclosure window to ensure affected websites had sufficient time to apply patches.

The discovery of these flaws underscores the impact of AI tools in security research. Such tools can uncover vulnerabilities in widely used code that may have existed for years or even decades. Each discovery creates a race to develop and deploy fixes before malicious actors can exploit the weaknesses.