PHP Foundation Admits Structural Failure After Critical Flaw Leaks

The PHP Foundation admitted to a structural failure and decision paralysis after a breakdown in its coordinated vulnerability disclosure process for two critical remote code execution flaws, known as PHP2Shell. The vulnerabilities, CVE-2026-109618 and CVE-2026-109619, allow attackers to seize server control and steal data. The foundation revealed it held the out-of-memory flaw for approximately two years after its initial identification in 2024.

The disclosure process collapsed when cybersecurity firm Calif mistakenly published a proof-of-concept attack video and Chainguard unilaterally broke the embargo by publishing fixes six hours early. This forced the PHP project to release patches 24 hours ahead of schedule. Chainguard CEO Dan Lorenc defended the early release, citing the ease of discovering the flaw and evidence of active exploits.

Threat intelligence from Amazon Web Services and Cloudflare confirmed that attackers attempted to exploit the flaws as early as October 17, days before the public announcement. Cloudflare reported thousands of attempts 10 hours before the official disclosure. The incident led numerous businesses and government agencies to take PHP-based servers offline to prevent attacks, highlighting the difficulty of maintaining embargoes during the rise of AI-assisted exploit development.