Early leak forces PHP to accelerate patch release for critical flaws

The standard four-week waiting period for PHP security updates was cut short this week. This change was necessary because details of two severe vulnerabilities reached the public domain before the official deadline. The PHP Foundation had intended to keep the information contained until a coordinated release. Instead, early leaks forced the organization to bring its public statement forward by one day. This shift disrupted the planned schedule for developers and website owners who rely on the language.

The two specific issues are identified as CVE-2026-109618 and CVE-2026-109619. Both carry a severity rating of 9.2, which places them in the critical category. These bugs exist within the core PHP runtime itself. They were not found through traditional manual testing but were discovered using artificial intelligence tools. The high score indicates a significant risk of remote code execution if left unpatched. The foundation prioritized a controlled rollout to give administrators time to prepare their systems.

The primary point of contention involves a user on Hacker News known as petecooper. This individual shared details of the flaws before the embargo ended. In a public statement, petecooper apologized for the timing. They explained that they wanted to warn others who track the PHP release cycle about the urgency of the matter. The user described themselves as a self-employed consultant and the sole founder of a mental health non-profit. They stated they had no formal ties to the organizations involved in the discovery or the fix.

Petecooper claimed they believed no restriction on sharing the information existed. They noted that their contact had told them there was no embargo, a claim that contact’s own source had also made. The user acknowledged the additional workload their post created for the foundation. They accepted full responsibility for the situation. However, they emphasized that causing these side effects was not their original intention. The statement highlighted the confusion surrounding the communication of the disclosure rules.

Petecooper was not the only source of early information. Several other leaks had already spread across social media and other platforms. This wider dissemination pushed the PHP Foundation to adjust its timeline. The organization also identified Chainguard as another entity that broke the silence. Chainguard released information more than six hours before the agreed-upon time. The foundation’s decision to move the announcement earlier was a direct response to this combined pressure from multiple early disclosures.

Dan Lorenc, the co-founder and CEO of Chainguard, defended the company's move. He posted on LinkedIn to explain his reasoning. Lorenc said he spoke with several other researchers before making the decision. He argued that once the fix became publicly available, it was better to notify the entire group immediately. This approach prioritized broad awareness over limiting the news to just the company's customers. His defense highlights the tension between strict embargo protocols and the desire for rapid information sharing in the security community.

The discovery of these flaws marks a shift in how vulnerabilities are found. The use of AI tools has become a key factor in uncovering these deep-seated bugs. These issues were not the result of attacks by rogue AI systems. Instead, they were identified through legitimate research efforts using these advanced tools. This trend suggests that AI will continue to help both security experts and malicious actors find weaknesses in widely used code. Such discoveries have often sat in systems for years or even decades before being detected.

This dynamic turns every new finding into a race. Teams must develop and deploy fixes as quickly as possible. The goal is to secure systems before the flaw can be exploited by attackers. The recent events underscore the challenge of managing this timeline. As AI tools become more common in security research, the pressure to balance disclosure timing with public awareness will likely increase. For now, the PHP community is focused on applying the patches released during this accelerated window.