PHP Foundation Accelerates Patch Release After Early Leak of Critical Runtime Bugs

The PHP Foundation has moved the release date for critical security patches forward by one day to October 24. The decision follows the premature public disclosure of two high-severity vulnerabilities in the PHP runtime. The foundation cited the need to minimize the window of exposure after details of the flaws spread before the planned coordinated disclosure date.

The timeline for the release shifted after a user named petecooper posted details on Hacker News. Petecooper shared information regarding CVE-2026-109618 and CVE-2026-109619, both remote code execution flaws rated 9.2 in severity. The user stated they believed the matter was urgent and wanted to warn others who follow PHP's four-week release cycle. Petecooper described themselves as a self-employed consultant and the founder of a mental health non-profit, noting they had no affiliation with the organizations involved in the disclosure.

In a public statement, petecooper apologized for the disruption. "I appreciate this has had considerable knock-on effects with the schedule for co-ordinated disclosure, and created additional workload. I am truly sorry. I take full responsibility for my actions," the user wrote. They claimed their contact had indicated there was no embargo, a detail that contact's source also reportedly confirmed. The user added that causing side effects was not their intention.

Petecooper was not the only source of early information. Several leaks had already circulated on social media and other platforms. The PHP Foundation also reported that Chainguard broke the embargo by more than six hours. Dan Lorenc, co-founder and CEO of Chainguard, defended the action on LinkedIn. He explained that he acted after consulting with other researchers and that he notified the broader group once the fix became public, rather than limiting the alert to his company's customers.

The two vulnerabilities exist in the core PHP runtime. Researchers discovered them using AI tools. The findings are not the result of attacks by rogue AI, but the use of such tools allows both security teams and malicious actors to uncover bugs that may have persisted in widely used code for years or decades. This dynamic turns each discovery into a race to develop and deploy fixes before the flaws can be exploited.

The PHP Foundation had originally planned a controlled public release. This approach would have given affected websites and applications time to apply patches before the flaws became widely known. Some recipients of the advance warning did not pass along the embargo that accompanied the CVEs, causing word to spread sooner than intended. The foundation's decision to move the date up by one day reflects the cumulative impact of these early disclosures.