PHP Foundation Moves Patch Release Up After Early Leaks

The PHP Foundation advanced its security patch release by one day on Thursday after details of two critical vulnerabilities leaked before the planned disclosure window closed. The organization moved the announcement from October 25 to October 24 to limit the exposure window for websites running the language.

The two flaws, tracked as CVE-2026-109618 and CVE-2026-109619, allow for remote code execution in the PHP runtime. Both carry a severity score of 9.2. Researchers discovered the bugs using AI tools, a method that can uncover vulnerabilities hidden in widely used code for years.

Hacker News user petecooper posted details of the flaws ahead of the embargo. In a public apology, the user said they shared the information to warn others following PHP's four-week release cycle that the issue was urgent. Petecooper described themselves as a self-employed consultant and the solo founder of a mental health non-profit. They stated they had no affiliation with the involved organizations and did not know an embargo existed.

Petecooper wrote, "I appreciate this has had considerable knock-on effects with the schedule for co-ordinated disclosure, and created additional workload. I am truly sorry. I take full responsibility for my actions." The user added that their contact had claimed there was no embargo, a statement that the contact's own source also made.

Chainguard also broke the embargo by more than six hours. Dan Lorenc, co-founder and CEO of Chainguard, defended the move on LinkedIn. He said he acted after consulting with other researchers and notified the wider group once the fix became public, rather than restricting the alert to company customers.

Some recipients of the advance warning failed to pass along the embargo instructions, causing information to spread faster than intended. The early leak forced the foundation to compress its timeline and push the public release forward by a full day.