PHP vulnerability disclosure dispute highlights shrinking patch windows
Two critical PHP flaws, collectively called PHP2Shell, could enable remote code execution and have prompted millions of exploitation attempts. The PHP Foundation says Chainguard broke an agreed embargo, leading to early patches and giving attackers a chance to study fixes. The dispute underscores how AI-assisted exploit development is reducing the time defenders have to patch.
The two flaws, tracked as CVE-2026-109618 and CVE-2026-109619, are rated 9.2 and can permit remote code execution. The PHP Foundation traced early signs of an out-of-memory issue to 2024, but deeper work began in July 2026, through OpenAI’s Patch the Planet effort with researchers from Calif, OpenAI, and Google Cloud’s Wiz.
A planned October 22 embargo shifted after CVE identifiers circulated on October 20. Calif briefly posted a proof-of-concept video, and Chainguard released fixed images on October 21 at 07:41 UTC, about six hours early. Public patches followed at 14:00 UTC, a day sooner than planned; AWS and Cloudflare reported exploitation before disclosure.
The episode could affect organizations relying on PHP, including businesses and public agencies, by shortening the time available to test and deploy fixes. If exploit code circulates quickly, smaller teams with limited security staff may face greater risk of service disruption or data compromise. The dispute may also push vendors and open-source maintainers toward clearer embargo rules and faster patch distribution, though it could strain trust among coordination partners.