9.2 severity score hits PHP developers after early leak of critical flaws

Website owners and developers relying on PHP now face a compressed window to apply critical security patches. The usual grace period, which allows time for testing and deployment before the public learns of a vulnerability, has been shortened due to an early leak of information about two high-severity bugs. This shift means that unpatched systems are exposed to potential remote code execution attacks sooner than originally planned.

The two vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, carry a severity rating of 9.2. These flaws exist within the PHP runtime itself, meaning they affect a broad range of applications that utilize the language. The discovery of these bugs has turned the standard security update process into a race against time, as the window between public knowledge and the availability of a fix has narrowed significantly.

The incident began when a Hacker News user known as petecooper posted details of the vulnerabilities before the scheduled embargo ended. In a public statement, the user apologized for the timing and took full responsibility for the disruption. Petecooper described themselves as a self-employed consultant and the founder of a mental health non-profit, noting they had no formal affiliation with the organizations involved in the disclosure process. They claimed their intent was to warn others about the urgency of the issue, given PHP’s four-week release cycle.

Petecooper stated that they believed no embargo was in place. They noted that their contact had told them there was no restriction on sharing the information, a claim that the contact’s own source had also made. The user acknowledged that their post created additional workload and knock-on effects for the coordinated disclosure schedule, expressing regret for the unintended consequences.

The PHP Foundation had initially planned a controlled public release to give affected parties time to prepare. However, the early leak was not the only factor that disrupted this timeline. Several other leaks had already appeared on social media and other platforms. Additionally, the foundation stated that the company Chainguard broke the embargo by more than six hours. These combined factors pushed the PHP Foundation to bring its official announcement forward by one day.

Dan Lorenc, co-founder and CEO of Chainguard, defended his company’s actions on LinkedIn. He explained that he acted after consulting with several other researchers. Lorenc stated that once the fix was released publicly, he chose to notify the broader group of researchers rather than limiting the alert to his company’s customers. This decision reflects a common tension in security circles between sharing information widely to protect the ecosystem and respecting specific disclosure agreements.

The two bugs were discovered using artificial intelligence tools, though they were not caused by rogue AI systems. This highlights a growing trend where AI assists in uncovering vulnerabilities that may have existed in widely used code for years or even decades. As these tools become more prevalent, the likelihood of finding deep-seated flaws increases. This dynamic intensifies the pressure on developers to identify and deploy fixes quickly, as each discovery triggers a race to secure systems before malicious actors can exploit them.

For the average user, the immediate impact is a heightened need to ensure that any website or application built with PHP is updated to the latest version. The shortened timeline reduces the buffer for organizations to test patches in staging environments before moving them to production. While the flaws were critical, the prompt action by the PHP Foundation and the availability of fixes offer a path to safety, provided that updates are applied without delay.