PHP Foundation says Chainguard broke security disclosure embargo before emergency patch release

The PHP Foundation says that on October 21, more than six hours before the coordinated release of emergency patches for two critical PHP remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, Chainguard unilaterally published container images containing the fixes, breaking the security disclosure embargo. Chainguard CEO Dan Lorenc said the company decided to release early because multiple security vendors reported exploitation in the wild, and said the company independently discovered the vulnerabilities using a testing framework and a frontier AI model; the Foundation said that the public PoCs it examined did not contain working exploit code before the release. The Foundation also said that a leak of the CVE identifiers and an accidentally published exploit demonstration video had previously disrupted the coordination process, and acknowledged that a memory management issue discovered in 2024 stalled multiple times due to decision-making processes and insufficient resources, and only became the top priority after Calif and OpenAI reported the same root cause in August; the security team has begun shifting to majority decision-making.