petecooper and Chainguard leak PHP CVEs, forcing Foundation to ship patches 24 hours early

The release date changed.

The PHP Foundation shifted its patch announcement forward by one day, setting the date for October 24. This acceleration followed the premature circulation of details regarding two critical vulnerabilities in the PHP runtime. Both flaws carry a severity rating of 9.2. The organization had originally planned a controlled disclosure to allow developers time to prepare. The early leaks compressed that window.

A user on Hacker News identified as petecooper posted the CVE identifiers, CVE-2026-109618 and CVE-2026-109619, before the embargo period ended. In a public apology, petecooper stated they had no affiliation with the involved organizations. They described themselves as a self-employed consultant and the founder of a mental health non-profit. The user said they shared the information to warn those tracking the four-week release cycle of the urgent nature of the issues. Petecooper wrote, "I appreciate this has had considerable knock-on effects with the schedule for co-ordinated disclosure, and created additional workload. I am truly sorry. I take full responsibility for my actions." The user claimed their contact had indicated there was no embargo, a position that contact's own source had also maintained.

Chainguard also contributed to the early disclosure. The company broke the embargo by more than six hours. Dan Lorenc, co-founder and CEO of Chainguard, defended the move on LinkedIn. He explained that he acted after consulting with several other researchers. Lorenc stated that once the fix was available publicly, he notified the entire research group rather than limiting the alert to Chainguard's customers. These actions, along with other social media posts, pushed the Foundation to finalize the earlier release date.

The vulnerabilities exist within the PHP runtime itself. Researchers discovered them using AI tools, not through attacks by rogue AI systems. These findings illustrate how such tools can help both defenders and malicious actors locate weaknesses in widely used code that may have persisted for years or decades. Each discovery now creates a race to develop and deploy fixes before the flaws are exploited.