PHP maintainers accuse Chainguard of releasing a PHP2shell fix image early

PHP maintainers accuse Chainguard of violating the coordinated disclosure embargo by publishing a PHP image containing fix code more than six hours before the planned release of the PHP2shell patch. The two vulnerabilities CVE-2026-109618 and CVE-2026-109619 can let attackers execute code remotely without authentication on some Apache mod_php servers; Chainguard CEO Dan Lorenc said the early release was because the vulnerabilities were already being exploited in the wild.