PHP Foundation Moves Patch Release After Early Leaks of Critical Runtime Bugs
A Hacker News user admitted to posting details of two 9.2 severity vulnerabilities before the planned disclosure date, prompting the foundation to accelerate its public announcement by one day.
By Sarah Montgomery ·
The PHP Foundation advanced its security announcement by one day after multiple early leaks exposed two critical remote code execution flaws. The shift in schedule came after a Hacker News user posted specific details about the bugs before the coordinated disclosure window closed. The foundation stated that several recipients of the advance warning failed to maintain the embargo, causing the information to spread faster than intended.
The user, identified as petecooper, issued a public apology for the premature post. They stated they shared the CVEs to warn other developers about the urgency of the issue during PHP's standard four-week release cycle. Petecooper described themselves as a self-employed consultant and the founder of a mental health non-profit, noting they had no formal ties to the organizations involved in the disclosure process. They wrote, "I take full responsibility for my actions," while adding that their contact had initially claimed no embargo existed.
The two vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, both carry a severity rating of 9.2. These bugs exist within the PHP runtime itself rather than in specific applications. The discovery process utilized AI tools, which the source notes can help researchers find hidden flaws in widely used code. This capability accelerates the need for rapid patching to prevent exploitation of long-standing security gaps.
Chainguard also broke the disclosure timeline, doing so by more than six hours according to the foundation. Dan Lorenc, the company's co-founder and CEO, defended the move on LinkedIn. He explained that he acted after consulting with other researchers. Once the fix became publicly available, Lorenc said he notified his broader network rather than limiting the alert to Chainguard's existing customers.
The early disclosure disrupted the planned controlled release. This strategy is designed to give affected websites and developers sufficient time to apply patches before the flaws become widely known. The missteps by petecooper and Chainguard forced the foundation to adjust its timeline to manage the rapid spread of information across social media and other platforms.
