PHP Flaw Leak: Embargo Breached Ahead of Schedule

A Hacker News user has apologized for releasing information about two critical security flaws in the PHP code base before an agreed-upon blackout period ended. The user, who goes by the name petecooper, posted details regarding remote code execution vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619, stating they did not realize a restriction on sharing existed.

The user explained that the intent was to alert those who follow the PHP four-week release cycle to the urgency of the situation. Describing themselves as a self-employed consultant and the founder of a mental health non-profit, they stated they have no affiliation with any organization involved in the release. In their statement, they wrote, "I appreciate this has had considerable knock-on effects with the schedule for co-ordinated disclosure, and created additional workload. I am truly sorry. I take full responsibility for my actions." They added that their contact had assured them no embargo was in place.

Both vulnerabilities carry a severity rating of 9.2. The PHP Foundation had planned a controlled release to allow website administrators time to apply patches before the weaknesses became public knowledge. However, the advance warning provided to recipients was not consistently passed along, and information regarding the flaws began circulating sooner than intended.

The Hacker News user was not the only source to break the embargo. Several leaks surfaced on social media and other platforms, prompting the PHP Foundation to move its announcement up by one day. The foundation also stated that Chainguard violated the embargo by more than six hours.

Dan Lorenc, co-founder and CEO of Chainguard, defended the decision in a LinkedIn post. He said he made the disclosure after consulting with several other researchers, and that he notified the group immediately after the fix was released publicly rather than waiting to alert only his company's customers.

These flaws were discovered within the PHP runtime itself using AI tools. While these were not the result of attacks by malicious artificial intelligence, such tools can assist both defenders and attackers in uncovering vulnerabilities that may have existed in code for years. Consequently, each discovery becomes a race to deploy a fix before the flaw can be exploited.