PHP maintainers have released emergency patches for two critical vulnerabilities, collectively dubbed PHP2shell, that allow unauthenticated attackers to execute code on servers running PHP. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, were found by researchers at Calif, OpenAI, and Wiz between August and September, with all three saying they used AI models to identify the bugs.
In a post-disclosure blog, the PHP Foundation accused supply chain security firm Chainguard of unilaterally breaking the coordinated disclosure embargo on October 21 by publishing built images containing the fix more than six hours before the planned release. The blog also noted that CVE IDs had already circulated on forums, prompting maintainers to move the release forward a day, and that Calif had mistakenly published a proof-of-concept video.
Chainguard CEO Dan Lorenc does not dispute the timeline but rejects the idea that his company leaked. He said Chainguard independently found the same vulnerabilities using an AI harness, helped test patches, and decided to ship fixes early after seeing evidence of active exploitation. "It's coordinated vulnerability disclosure, unless there's evidence of active exploits in the wild," he told The Register. Lorenc said he would not do anything differently, and that Chainguard's honeypots had trapped IPs from China and Russia targeting the vulnerabilities.
The two sides agree on the facts of the timeline but differ on whether early release was justified. PHP maintainers say the move disregarded weeks of coordinated disclosure work; Chainguard argues that active exploitation made immediate fixes necessary.