PHP Maintainers Accuse Chainguard of Leaking Critical PHP2shell Vulnerabilities

PHP maintainers released emergency security patches on Wednesday for two critical vulnerabilities collectively dubbed PHP2shell, following a disruption in the coordinated disclosure process. The PHP Foundation explicitly accused software supply chain security company Chainguard of effectively revealing the bugs before the planned official announcement.

The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, allow unauthenticated attackers to execute arbitrary code on servers running the PHP scripting language. Researchers from Calif, OpenAI, and Wiz identified the security holes between August and September, stating that they utilized artificial intelligence models to find the flaws.

Disclosure Disruption and Timeline

According to the PHP Foundation blog, the trouble began on Tuesday at approximately 15:00 UTC when the two CVE IDs started circulating on online forums and social media. This premature exposure included incorrect information regarding the release time and CVSS severity ratings, though no technical details of the exploits were leaked at that stage.

The rumors prompted PHP maintainers to issue an advance warning about the critical flaws and move the planned disclosure forward by one day, from Thursday to Wednesday. The Foundation stated that distributors were still packaging the fix, so an immediate release would have left many users without an easy update path.

Impact on Web Infrastructure

The severity of these flaws is heightened because PHP powers a significant portion of the public web. The incident adds irony to the situation, as Chainguard aims to secure software supply chains by hardening open-source code, yet its actions are blamed for the messy disclosure.

Chainguard CEO defended the company’s stance in a statement to The Register, emphasizing the importance of coordinated vulnerability disclosure unless there is evidence of active exploits in the wild. The PHP developers’ blog post highlights the tension between rapid disclosure and the practical realities of software distribution.

What should you do?

System administrators should verify that their PHP installations have been updated with the emergency patches released on Wednesday. Organizations relying on PHP-based applications must ensure their distribution channels have packaged and delivered the fixes. Monitoring for unusual server activity remains prudent while patches are deployed across large infrastructures.

Background: Coordinated vulnerability disclosure

Coordinated vulnerability disclosure reveals software flaws to vendors before public release. Small teams must patch during this quiet period. Monitor vendor security pages, prioritize critical updates, and verify that your IT provider tracks these disclosures to prevent exploitation of known weaknesses before public patches arrive.

Read the full guide: Coordinated Vulnerability Disclosure for Small Teams

What to do and how to stay safe: PHP

• Check your PHP version and apply the emergency patches released on Wednesday to mitigate CVE-2026-109618 and CVE-2026-109619.
• Monitor server logs for signs of unauthenticated remote code execution attempts or unusual activity following the disclosure.
• Coordinate with your software distributors to ensure they have packaged and released the fixes for your specific platform.
• Review your incident response plans to handle potential disruptions caused by premature vulnerability disclosures in the future.

Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What are the CVE IDs for the PHP2shell vulnerabilities?

The vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619.

Who discovered the PHP2shell vulnerabilities?

Researchers at Calif, OpenAI, and Wiz discovered the vulnerabilities between August and September using AI models.

Why did PHP maintainers move the disclosure date forward?

The circulation of CVE IDs on social media prompted maintainers to advance the disclosure from Thursday to Wednesday to balance speed and update availability.