PHP Foundation rushes 9.2 severity patch release after Hacker News and Chainguard leak details
A Hacker News post and a Chainguard notification forced the foundation to move its security announcement up by one day, citing two 9.2 severity vulnerabilities in the runtime.
By Layla Fontaine ·
The PHP Foundation moved its critical security announcement up by one day after details of two high-severity vulnerabilities leaked before the scheduled embargo ended. The foundation confirmed that the early disclosure forced a change in its release timeline to ensure affected users could apply patches immediately.
The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, are remote code execution flaws in the PHP runtime. Both carry a severity rating of 9.2. The foundation had planned a controlled public release to give websites and applications time to prepare. However, the embargo broke when a Hacker News user named petecooper posted details of the flaws. Petecooper later apologized, stating they had no idea an embargo existed and were trying to warn others following the four-week release cycle. They described themselves as a self-employed consultant and the founder of a mental health non-profit, noting they had no affiliation with the organizations involved.
Petecooper wrote that they took full responsibility for the additional workload created by the leak. They added that their contact had told them there was no embargo, a claim that contact’s source had also made. The post was not the only early leak. Several reports had already circulated on social media, prompting the foundation to act quickly.
The foundation also identified Chainguard as a source of the early leak, noting the company broke the embargo by more than six hours. Dan Lorenc, co-founder and CEO of Chainguard, defended the move on LinkedIn. He said he acted after speaking with several other researchers. Lorenc stated that once the fix was released publicly, he promptly notified the wider group rather than just his company’s customers.
The two bugs reside in the core PHP runtime. Researchers discovered them using AI tools, not through attacks by rogue AI systems. The use of such tools allows both security researchers and malicious actors to uncover vulnerabilities that may have sat in widely used code for years or even decades. This dynamic turns each discovery into a race to develop and deploy a fix before the flaw can be exploited.
The PHP Foundation scheduled the updated release for the following day. The advance notification allows administrators to patch their systems before the details become widely known. The foundation did not announce further changes to its disclosure policy in the immediate statement.
