PHP Foundation moves patch release to October 24 after early leaks of 9.2 severity flaws

The PHP Foundation moved its scheduled security patch release forward to October 24, 2026, after details of two critical vulnerabilities were disclosed ahead of the planned embargo. The foundation had originally targeted a controlled release to allow developers time to prepare, but early leaks forced a change in the schedule.

The two bugs, identified as CVE-2026-109618 and CVE-2026-109619, allow for remote code execution and are rated 9.2 in severity. These flaws exist within the core PHP runtime. The foundation stated that some recipients of the advance warning did not communicate the embargo restrictions, causing the information to spread sooner than intended.

A Hacker News user named petecooper posted the details of the vulnerabilities before the embargo lifted. In a public statement, the user apologized and said they were unaware an embargo existed. Petecooper, a self-employed consultant and founder of a mental health non-profit, said they shared the information to warn others following the PHP release cycle. They claimed a contact told them there was no embargo, a claim that contact's source also made.

Petecooper acknowledged that their actions created additional workload and knock-on effects for the coordinated disclosure process. "I take full responsibility for my actions," the user wrote. They added that causing side effects was not their intention.

Other early leaks also contributed to the schedule shift. The PHP Foundation noted that Chainguard broke the embargo by more than six hours. Dan Lorenc, co-founder and CEO of Chainguard, defended the decision on LinkedIn. He stated that he spoke with several researchers before acting and notified a wider group once the fix was publicly available, rather than just his company's customers.

Researchers discovered these runtime bugs using AI tools. The foundation clarified that the flaws were not the result of attacks by rogue AI. The use of such tools in security research creates a race to develop and deploy fixes before vulnerabilities can be exploited, a dynamic that affects how quickly patches must be released.

The next step is the public release of the patches on October 24. Developers and administrators for PHP-based applications are expected to apply these updates to address the remote code execution risks.