Chainguard discloses AI-discovered PHP vulnerabilities early; multiple countries respond urgently
Start here
On October 21, more than six hours before the coordinated emergency patch release for two critical PHP remote code execution vulnerabilities (CVE-2026-109618, CVE-2026-109619), Chainguard published container images containing the fix code, and the PHP Foundation accused it of unilaterally breaking the coordinated disclosure embargo. The two vulnerabilities could allow attackers to execute code remotely without authentication on some Apache mod_php servers, and PHP is estimated to be integrated into about 70% of websites. Chainguard CEO Dan Lorenc said the early release was due to reports from multiple security vendors of exploitation in the wild, and said the company independently discovered the vulnerabilities using a testing framework and a frontier AI model; it later apologized but maintained this reason; POLITICO reported that the vulnerabilities were coordinated by OpenAI and discovered using AI tools. The incident triggered emergency warnings from cyber agencies in Europe, the US, the UK, Australia and Canada, and government websites in multiple countries were taken offline as a precaution; Cloudflare CEO Matthew Prince said exploitation attempts increased sharply from thousands in the 10 hours before the announcement. Another engineer's analysis noted that Japanese Prime Minister Sanae Takaichi directly called on X for prompt patching, shortening companies' internal decision time on service shutdowns.
Generated by AI from reports · Updated 6 days ago
Latest developments
Progress timeline
- POLITICOSelectedThe AI threat comes true: inside the PHP vulnerability emergency
Chainguard 提前披露由 OpenAI 协调、用 AI 工具发现的 PHP 漏洞，触发欧美英澳加网络机构紧急警告，多国政府网站预防性下线。PHP 据估计集成于约 70% 的网站。Chainguard CEO Dan Lorenc 道歉但称漏洞已遭利用才提前公开，PHP Foundation 指其单方面破坏了协同披露禁令。Cloudflare CEO Matthew Prince 称利用尝试从公告前 10 小时的数千次增至目前的数百万次，亚马逊云部门称漏洞已在野外被广泛利用。OpenAI 称这类漏洞只是其已发现并正在修复的多个重要漏洞的一部分，预计未来数月类似发现将急剧增加。
- QiitaWhen explaining to clients, it helps to be able to say "Prime Minister Takaichi said this too": the top-down decision-making seen in the PHP emergency maintenance and vulnerability response in the AI era
The author analyzes the PHP emergency maintenance incident from an engineer's perspective, arguing that Prime Minister Takaichi's rare direct call on X to apply patches as soon as possible made management treat the vulnerability risk as their own matter and shortened the internal decision-making time for companies suspending services. The PHP project released versions fixing two emergency-level vulnerabilities that allow arbitrary code execution from outside without authentication (8.5.12 / 8.4.27 / 8.3.36 / 8.2.35, CVE-2026-109618 and CVE-2026-109619, collectively called php2shell); before the fixed versions were published, vulnerability information and a PoC had already leaked and attack attempts were observed, and BASE, pixiv, niconico and others proactively suspended services; the Prime Minister said that temporarily taking a site down is also an effective risk-reduction measure when patching is difficult, and the fixed versions were published about 1 hour after the call.
- LavX NewsPHP maintainers accuse Chainguard of releasing a PHP2shell fix image early
PHP maintainers accuse Chainguard of violating the coordinated disclosure embargo by publishing a PHP image containing fix code more than six hours before the planned release of the PHP2shell patch. The two vulnerabilities CVE-2026-109618 and CVE-2026-109619 can let attackers execute code remotely without authentication on some Apache mod_php servers; Chainguard CEO Dan Lorenc said the early release was because the vulnerabilities were already being exploited in the wild.
- SocketPHP Foundation says Chainguard broke security disclosure embargo before emergency patch release
The PHP Foundation says that on October 21, more than six hours before the coordinated release of emergency patches for two critical PHP remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, Chainguard unilaterally published container images containing the fixes, breaking the security disclosure embargo. Chainguard CEO Dan Lorenc said the company decided to release early because multiple security vendors reported exploitation in the wild, and said the company independently discovered the vulnerabilities using a testing framework and a frontier AI model; the Foundation said that the public PoCs it examined did not contain working exploit code before the release. The Foundation also said that a leak of the CVE identifiers and an accidentally published exploit demonstration video had previously disrupted the coordination process, and acknowledged that a memory management issue discovered in 2024 stalled multiple times due to decision-making processes and insufficient resources, and only became the top priority after Calif and OpenAI reported the same root cause in August; the security team has begun shifting to majority decision-making.
Related discussion
- Older than 72 hours · Not included in the 72-hour figures
- X@taryn_plumb · Taryn PlumbThe PHP Foundation says @chainguard_dev broke an agreed embargo on two critical flaws, while vendors report #exploitati…(opens the original post in a new tab)
Attention trend
New sources per day
- Oct 22: 3 new sources (3 outlets, 0 accounts)
- Oct 23: 1 new sources (0 outlets, 1 accounts)
- Oct 24: 1 new sources (1 outlets, 0 accounts)
- Oct 25: 0 new sources (0 outlets, 0 accounts)
- Oct 26: 0 new sources (0 outlets, 0 accounts)
- Oct 27: 0 new sources (0 outlets, 0 accounts)
- Oct 28: 0 new sources (0 outlets, 0 accounts)
- Oct 29: 0 new sources (0 outlets, 0 accounts)
- Oct 30: 0 new sources (0 outlets, 0 accounts)