PHP Foundation advances patch release after early leak of critical flaws

The PHP Foundation moved its planned announcement forward by one day after details of two critical vulnerabilities leaked ahead of a coordinated disclosure.

The two flaws, tracked as CVE-2026-109618 and CVE-2026-109619, are bugs in the PHP runtime itself. Both carry a severity score of 9.2, a high rating that indicates the potential for remote code execution. The foundation had intended to release a controlled public notice to allow affected websites and applications time to apply patches before the flaws became widely known.

The leak originated in part from a Hacker News user who goes by the handle petecooper. That user posted the CVE details before the embargo ended. In a statement, petecooper apologized for the timing, saying they did not know a restriction existed. They described themselves as a self-employed consultant and the solo founder of a mental health non-profit, stating they had no affiliation with the involved organizations. "I take full responsibility for my actions," petecooper wrote.

The user explained that they shared the information to warn others who follow the PHP four-week release cycle that the matter was urgent. Petecooper noted that a contact had said there was no embargo, a claim that the contact's source had also made. The user said the unintended side effects created additional workload for the foundation.

Petecooper was not the only source of early information. Several leaks had already circulated on social media and other platforms. The PHP Foundation also identified Chainguard as having broken the embargo by more than six hours. Dan Lorenc, co-founder and CEO of Chainguard, defended the decision on LinkedIn. He said he acted after speaking with several other researchers and promptly notified the group once the fix was released publicly.

The two vulnerabilities were found using AI tools. They were not the result of attacks by rogue AI systems. The discovery process highlights how such tools can help security researchers and malicious actors uncover vulnerabilities in widely used code that may have remained hidden for years.

Each discovery creates a race to develop and deploy a fix before the flaw can be exploited. The foundation’s earlier release date aims to give administrators a head start in applying the necessary updates.