PHP Foundation Pulls Patch Release Forward After Early Flaw Disclosures

The PHP Foundation moved its patch release up by one day to Oct. 24 after details of two critical runtime vulnerabilities appeared publicly ahead of a planned disclosure embargo. The two flaws, tracked as CVE-2026-109618 and CVE-2026-109619, are both rated 9.2 in severity.

A Hacker News user who goes by petecooper posted the CVE identifiers before the embargo period ended. The user apologized for the disclosure, saying they had no knowledge that a restriction was in place. "I appreciate this has had considerable knock-on effects with the schedule for co-ordinated disclosure, and created additional workload. I am truly sorry. I take full responsibility for my actions," petecooper wrote.

Petecooper said they shared the identifiers to alert others who track PHP's four-week release cycle that the issue needed attention. The user described themselves as a self-employed consultant with no affiliation to the organizations involved, and said their contact had told them no embargo existed. That contact's own source had made the same claim.

The PHP Foundation had planned a controlled release to give affected sites and applications time to install patches before the flaws became widely known. Advance warnings went out to recipients, but several did not relay the embargo attached to the CVEs, and the details spread. Chainguard broke the embargo by more than six hours, the foundation said.

Chainguard co-founder and CEO Dan Lorenc defended the timing on LinkedIn, saying he acted after speaking with several other researchers. Once the fix was released publicly, Lorenc said, he notified the group rather than only his company's customers.

Both vulnerabilities are bugs in the PHP runtime itself and were found using AI tools. The discovery of such flaws in widely used code can take years to surface, which turns each finding into a race to ship a fix before the flaw can be exploited.