PHP Maintainers Say Early Leaks Forced a Rushed Disclosure of Two Critical Flaws

PHP maintainers have released emergency patches for two critical vulnerabilities, collectively called PHP2shell and tracked as CVE-2026-109618 and CVE-2026-109619. The flaws can allow an unauthenticated attacker to run code on servers running PHP, which powers huge chunks of the public web. Researchers at Calif, OpenAI and Wiz found the bugs between August and September, and all three have said they used AI models to do so.

The disclosure did not go to plan. According to the PHP Foundation, two CVE IDs began circulating on forums and social media on Tuesday, along with incorrect information about the release time and severity rating. No technical details had leaked at that point. The maintainers moved the planned release forward a day, from Thursday to Wednesday, saying this balanced acting quickly against giving distributors time to package the fix. A few hours later, Calif mistakenly published a video showing a proof-of-concept exploit, along with limited additional information. The PHP blog also says mitigation advice shared with a few critical infrastructure providers may have leaked.

The PHP developers have blamed Chainguard, a software supply chain security company, for the messy disclosure. Chainguard's CEO told The Register the company follows coordinated vulnerability disclosure unless there is evidence of active exploits in the wild. This summary covers only the opening of the original report.