PHP developers have accused software supply chain security firm Chainguard of breaking a coordinated vulnerability embargo and revealing critical bugs that affect servers running the open-source scripting language, which powers roughly 70 percent of all websites worldwide. The accusations appeared in a blog post published Wednesday by the PHP Foundation, just hours after the project released emergency patches for two vulnerabilities collectively called PHP2shell. The post credits researchers at Calif, OpenAI, and Wiz with discovering the security holes between August and September using AI models, but saves its harshest criticism for Chainguard, claiming the company "unilaterally broke the embargo" more than six hours before the planned coordinated release.

According to the PHP Foundation's account, problems began Tuesday around 15:00 UTC when two CVE identifiers started circulating on online forums and social media, accompanied by inaccurate information about release timing and severity scores. The rumors forced PHP maintainers to alert users in advance about the critical flaws and move their planned disclosure forward one day, from Thursday to Wednesday. A couple of hours later, Calif "mistakenly" published a video demonstrating a proof-of-concept exploit with additional limited information about the bugs. Then on October 21st at 07:41 UTC, Chainguard published built images containing the fix, allowing any attacker to study the patch in binary form while other PHP users waited for the official release. The two bugs, now tracked as CVE-2026-109618 and CVE-2026-109619, permit an unauthenticated attacker to execute code on servers running PHP, and every PHP version released in the last decade is affected by at least one of them, going back to version 5.4.

Chainguard CEO Dan Lorenc told The Register his company "didn't leak" and defended the decision to ship fixes early, saying "people were getting hit in advance" of the official PHP disclosure. Lorenc learned "something was coming in PHP" on Friday from one of the researchers who found the bugs, and that same night his team independently discovered the same memory corruption vulnerabilities using a frontier AI model with "a basic prompt of 'find bad vulnerabilities in PHP.'" On Saturday, Chainguard began working with PHP maintainers and helped test the patches, but late Tuesday night Lorenc decided to ship the fixes and make built artifacts accessible to anyone after seeing proof-of-concepts posted on social media and reports from other security vendors about real-world exploitation. "It's coordinated vulnerability disclosure, unless there's evidence of active exploits in the wild," Lorenc said, adding that Chainguard's honeypots trapped IPs from China and Russia targeting the vulnerabilities on Wednesday. When asked if he would do anything differently, Lorenc said no.

Both vulnerabilities stem from how PHP handles memory management and error handling, and both lead to remote code execution. CVE-2026-109618 triggers RCE through out-of-memory corruption: if a request reached PHP's memory_limit at precisely the wrong moment, PHP could leave partially initialized internal data behind and later treat it as valid, corrupting memory. On Apache with mod_php, an unauthenticated request can trigger this before any application code runs. CVE-2026-109619 allows RCE via stale state, where a fatal error at the wrong point could leave internal state pointing to memory that belonged to a previous request, and a later request handled by the same worker could then use that freed memory. Threat hunters warn that successful exploitation could allow attackers to take control of affected servers, steal sensitive data, and deface websites. Wiz researchers advised immediate patching, while Lorenc predicted the new normal means people can "build an exploit in hours without even knowing what the vulnerability is." The messy disclosure highlights the tension between coordinated vulnerability management and responding to active threats, a balance that becomes harder to strike when AI tools can discover and weaponize bugs faster than traditional patch cycles allow. For organizations running PHP infrastructure, the calculus has shifted: waiting for perfect coordination may cost more than acting on imperfect intelligence.