PHP Patch Timeline Shifts: Community Leaks Force Earlier Release

The PHP Foundation moved its official announcement forward by one day on Thursday, a direct response to multiple early leaks that exposed details of two critical security flaws before the planned embargo ended. The shift in schedule followed a public apology from a Hacker News user who had shared the specific vulnerabilities with the broader community.

The user, known online as petecooper, posted details regarding CVE-2026-109618 and CVE-2026-109619, two remote code execution bugs within the PHP runtime. Both issues carry a severity rating of 9.2. Petecooper stated they shared the information to warn users following PHP's four-week release cycle about the urgency of the matter. They described themselves as a self-employed consultant and the founder of a mental health non-profit, noting they had no formal affiliation with the organizations involved in the disclosure.

In their written statement, petecooper acknowledged the impact on the coordinated disclosure schedule. "I appreciate this has had considerable knock-on effects with the schedule for co-ordinated disclosure, and created additional workload. I am truly sorry. I take full responsibility for my actions," they wrote. The user added that their contact had indicated no embargo existed, a claim that contact's own source had also made.

Petecooper was not the sole source of early information. Several other leaks had already circulated on social media and other platforms. The PHP Foundation noted that Chainguard broke the embargo by more than six hours. Dan Lorenc, co-founder and CEO of Chainguard, defended his company's actions on LinkedIn. He said he acted after speaking with several other researchers and that he promptly notified the group once the fix was publicly released, rather than limiting the notice to only the company's customers.

The two flaws are bugs in the core PHP runtime that researchers identified using AI tools. They were not the result of attacks by rogue AI systems. The use of such tools allows both security researchers and malicious actors to uncover vulnerabilities that may have remained hidden in widely used code for years or even decades. This dynamic turns each discovery into a race to develop and deploy a fix before the flaw can be exploited.

The PHP Foundation had planned a controlled public release to give affected websites and applications time to apply patches before the flaws became widely known. Some recipients of the advance warning did not pass along the embargo, causing the information to spread sooner than intended. The foundation's decision to bring the announcement forward aims to manage the rollout in light of these early disclosures.