Embargo Broken on Critical PHP Flaws
A Hacker News user who shared news about recent PHP vulnerabilities revealed by ChatGPT Sol before an embargo, which they claimed to be unaware of, has taken to the platform to apologize for the post. According to petecooper, they shared the CVEs because they wanted to alert others who follow the four-week PHP release cycle about the importance and urgency of the matter, but they weren't aware of the news blackout that went with the two identified vulnerabilities.
The user said they have no connection or affiliation to any of the organizations involved, noting they are a self-employed consultant for their day job and a solo founder of a mental health non-profit on the side. Petecooper's original post about the vulnerability was among the first to break the NDA, though they claim they were unaware.
Apology Issued for Disclosure Disruption
The poster wrote that they posted about the then-upcoming PHP RCEs related to CVE-2026-109618 and CVE-2026-109619, acknowledging that it had considerable knock-on effects with the schedule for coordinated disclosure and created additional workload. They stated they take full responsibility for their actions and that at the time of posting, they did not know about any embargo because their contact had told them there was no embargo.
CVE-2026-109618 and CVE-2026-109619 are two critical vulnerabilities, both scored at 9.2. It seemed that the PHP Foundation planned for a controlled public release, allowing affected websites and applications to be patched before the vulnerabilities became widely known. Unfortunately, some recipients of the warning failed to share the embargo that came alongside the CVEs, spreading the news earlier than expected.
Broader Leaks Force Schedule Change
Petecooper apparently wasn't the only one who leaked the news early, as multiple leaks had already been circulating on social media and other platforms, forcing the PHP Foundation to move its announcement up by one day. Despite that, the organization mentioned that Chainguard broke the embargo by more than six hours. Dan Lorenc, the co-founder and CEO of Chainguard, defended the move, saying he made the call after talking to several other researchers and immediately notified the group after releasing the fix publicly.
The vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619 were bugs in the PHP runtime itself discovered using AI tools, not attacks by rogue AI. Still, the abilities of this technology could make it easier for both security researchers and bad actors to find vulnerabilities that could have been lurking in widely used code for years, making it a race to find and deploy a fix before exploitation.
