PHP Foundation moves patch release to Oct 24 after leaks
Two critical flaws in the PHP runtime force an accelerated timeline as details circulate ahead of the planned announcement.
By Carolina Wood ·
Websites and applications built on PHP must update their software by October 24, 2026, to protect against two severe security flaws. The PHP Foundation advanced the release of security patches by one day following early leaks of vulnerability details. This change shortens the window for developers to apply fixes before the issues become widely known.
The vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619. Both carry a severity rating of 9.2. They allow for remote code execution, meaning an attacker could potentially run malicious code on a server without physical access. The bugs exist in the core PHP runtime, the software that processes PHP code on web servers.
A user on Hacker News who goes by petecooper posted details of the flaws before the planned disclosure date. In a public statement, petecooper apologized for breaking the silence. They described themselves as a self-employed consultant and the founder of a mental health non-profit. Petecooper said they shared the information to warn others following PHP's four-week release cycle that the situation was urgent. They stated they had no affiliation with the organizations involved and believed no restriction existed because their contact said so.
The leak from petecooper was not the only instance of early disclosure. Other warnings had already circulated on social media. The PHP Foundation stated that Chainguard also broke the agreement by more than six hours. Dan Lorenc, co-founder and CEO of Chainguard, defended his company's actions on LinkedIn. He explained that he consulted with other researchers before deciding to act. Once the fix was public, he said he notified the entire group rather than just the company's customers.
Researchers discovered these bugs using artificial intelligence tools. The flaws were not caused by rogue AI systems but were found by humans using AI assistance to scan code. This method highlights how such tools can uncover issues in widely used code that may have existed for years or decades. Each discovery creates a race to develop and deploy a fix before attackers exploit the weakness.
The PHP Foundation originally planned a controlled release to give affected sites time to patch. The early leaks disrupted this coordinated approach. The foundation has now set the new release date for October 24. Users of PHP are advised to check their systems and apply the updates as soon as they are available to mitigate the risk of exploitation.
