9.2: The CVSS Score That Forced a One-Day Shift in PHP Patching
A premature leak of two critical runtime flaws led the PHP Foundation to accelerate its coordinated disclosure by 24 hours.
By Pedro Barnes ·
The PHP Foundation moved its security announcement forward by one day after two critical vulnerabilities leaked ahead of schedule. Both flaws, tracked as CVE-2026-109618 and CVE-2026-109619, carry a severity rating of 9.2. The early release of details disrupted the planned controlled disclosure intended to give developers time to patch their systems.
The initial leak came from a Hacker News user identified as petecooper. In a public statement, petecooper apologized for sharing the CVEs before the embargo ended. The user described themselves as a self-employed consultant and the founder of a mental health non-profit. They stated they had no affiliation with the organizations involved and believed the urgency of the issue warranted an early warning to those following PHP's four-week release cycle. Petecooper wrote, "I appreciate this has had considerable knock-on effects with the schedule for co-ordinated disclosure, and created additional workload. I am truly sorry. I take full responsibility for my actions." The user added that their contact had claimed no embargo existed, a claim that contact's source also made.
The foundation noted that other leaks had already circulated on social media, contributing to the decision to shift the timeline. Chainguard, a separate entity, also broke the embargo by more than six hours. Dan Lorenc, co-founder and CEO of Chainguard, defended the move on LinkedIn. Lorenc said he consulted with other researchers before acting. He explained that once the fix became public, he notified the wider group rather than limiting the alert to company customers.
The two bugs exist within the PHP runtime itself. Researchers used AI tools to discover them. The findings were not the result of attacks by rogue AI systems. However, the use of such tools means both researchers and malicious actors can uncover vulnerabilities that have remained hidden in widely used code for years or decades. This dynamic creates a race to deploy fixes before the flaws are exploited in the wild.
The PHP Foundation planned a coordinated disclosure to manage the rollout of patches. The early leaks compressed that window. The foundation adjusted its schedule to release the details one day earlier than initially intended. This change aimed to align the public announcement with the reality of the information already circulating.
