Two critical PHP flaws leaked early after embargo broken
Affected sites had less time to patch than planned, adding pressure to how quickly maintainers can respond to AI-found bugs.
A developer who posted news of two critical PHP runtime flaws, CVE-2026-109618 and CVE-2026-109619, before their coordinated disclosure has apologised, saying they believed no embargo applied because a contact had said so. The two bugs are each scored 9.2 and were found with AI tooling rather than by attackers. The PHP Foundation had planned a controlled release so affected sites could be patched first, but leaks on social media forced it to bring its announcement forward by a day. The Foundation also said Chainguard broke the embargo by more than six hours; its CEO defended the decision, saying he had consulted other researchers and informed the wider community once the fix was public. The episode shows how quickly AI-assisted bug discovery is turning patching into a race against exploitation.
Why it matters
For people who run PHP-based sites, the practical change is that the window to patch before public disclosure was shortened by a day after leaks on social media. The Foundation's controlled release was meant to let sites fix the flaws first, so an early leak removes that cushion. The episode also shows that bugs found with AI tooling can reach public view quickly, making fast patching more pressing for anyone responsible for a live PHP deployment.
Series Critical PHP flaws
- IT teams scramble to patch critical PHP flaw as no large breaches are confirmed
- Two critical PHP flaws leaked early after embargo broken
- PHP flaws prompt urgent patching across the web as attack attempts climb
- Attacks on PHP2Shell flaws began four days before patches shipped, Amazon says
- PHP Flaws Prompt Precautionary Site Takedowns Worldwide
- Two critical PHP flaws found with AI tooling prompt patched releases
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.