PHP Patches Ship Early After Leak

Two critical flaws in the PHP runtime, each rated 9.2 in severity, triggered a compressed release schedule for the PHP Foundation. The organization moved its public announcement forward by one day, bringing the patch date to October 24, 2026. This shift followed an early leak of details regarding CVE-2026-109618 and CVE-2026-109619.

A user on Hacker News identified as petecooper posted information about the vulnerabilities before the planned disclosure window closed. petecooper issued a public apology, stating they had no knowledge of an existing embargo. The user described themselves as a self-employed consultant and the founder of a mental health non-profit. They said their contact had assured them no restriction was in place, a claim that contact’s source also made. petecooper wrote, "I take full responsibility for my actions."

The leak was not isolated to the forum post. Several other early disclosures circulated on social media, adding to the pressure on the PHP Foundation. The organization also noted that Chainguard broke the embargo by more than six hours. Dan Lorenc, co-founder and CEO of Chainguard, defended the timing on LinkedIn. He explained that he spoke with other researchers before acting. Once the fix was public, he said he notified the broader group immediately rather than limiting the alert to Chainguard’s customers.

The PHP Foundation had originally planned a controlled release. This approach would have given website operators time to apply fixes before the flaws became widely known. The early disclosures disrupted that timeline. The two bugs exist in the PHP runtime itself. Researchers used AI tools to find them, though the flaws were not caused by rogue AI. These tools can help both defenders and attackers locate vulnerabilities in widely used code that may have existed for years. Each discovery creates a race to deploy a fix before the flaw is exploited.