PHP released fixes for two critical vulnerabilities a day earlier than planned after details surfaced online before the scheduled disclosure, disrupting about two months of coordinated handling led by OpenAI.
The vulnerabilities, CVE-2026-109618 and CVE-2026-109619, are collectively referred to as PHP2Shell. According to the report, both could allow an unauthenticated attacker to run their own code on servers running PHP.
Leak forced PHP to move up the release
PHP had planned to disclose the two flaws at 10 p.m. UTC+8 on Oct. 22. Instead, related information began circulating around 11 p.m. on Oct. 20 on online forums and social platforms, including Hacker News. PHP then moved the release forward by one day to 10 p.m. on Oct. 21.
OpenAI said it led the security coordination effort and spent the previous two months working with maintainers, researchers and security companies in a coalition formed to address the issue.
PHP Foundation member Alexandre Daubois wrote on his personal blog that there were several leak points on the same day. One was an anonymous Hacker News post citing 「reliable sources」. The post was later removed, but screenshots had already spread to X and Mastodon. At roughly the same time, a screenshot of a PHP2Shell tool labeled Calif.IO also leaked.
Timeline began on July 30
The sequence began on July 30, when security company Calif audited PHP under OpenAI’s Patch the Planet program. On Aug. 11, Calif and OpenAI each reported the same root cause on the same day. In a later explanation, the PHP Foundation said signs of that root cause had already appeared in 2024.
On Sept. 25, a pull request for the fix was opened. Daubois said the change touched 390 files.
The circle of people informed in advance was not small. OpenAI said it worked with maintainers and research partners to test patches and prepare guidance, coordinated with infrastructure providers so defenses would be ready, and contacted the White House Superintelligence Working Group, the Office of the National Cyber Director, the Cybersecurity and Infrastructure Security Agency, and international partners.
Linux distributions and long-term support vendors also received the fixes ahead of public disclosure so users could update on release day.
OpenAI did not publish a full list of participants or a headcount, saying the maintainer group determined who would be included. Under OpenAI’s framework, different participants received different levels of information, ranging from network records to working exploit code. OpenAI said even limited details can expose a vulnerability, which means the process requires balancing the risk of sharing information against the defensive value of doing so.
More incidents followed after the initial leak
At 3:30 a.m. on Oct. 21, php.net posted an early notice saying the release had been moved to 10 p.m. that night. The PHP Foundation later said it did not publish immediately because distributions were still packaging the fixes. Releasing at once would have left many users without a simple update path, so moving the disclosure up by one day was presented as a compromise.
The notice also said PHP reserved the right to move even earlier if details became public or if real-world attacks appeared.
Around 4 a.m., one of the reporters, Calif, was said to have accidentally posted a video showing a proof-of-concept exploit working against multiple targets, exposing some additional limited details. The video was deleted, but copies spread across social platforms and accelerated the appearance of more PoCs.
The PHP Foundation said it began providing mitigation guidance to a small number of critical infrastructure providers from around 7 a.m., and that guidance may also have leaked. The foundation said it monitored leaked PoCs and had not found a usable exploit by the time of release.
Chainguard release became the main flashpoint
The sharpest dispute came at 3:41 p.m., when Chainguard released patched images more than six hours ahead of the coordination schedule. These images were prepackaged environments that included the fixes and could be deployed directly.
The PHP Foundation described the move as a 「unilateral embargo break」. Its position was that participants had agreed not to publish before the coordinated disclosure time, and that attackers could study the binaries to infer the patch while other PHP users were still waiting for official updates.
Chainguard CEO Dan Lorenc responded in a Hacker News comment that he had been coordinating with his team throughout the process, but 「when attacks appeared in real environments, I decided to release early」. He also said the images were provided free of charge.
The two accounts remain in conflict. The PHP Foundation said it had not seen a usable exploit at the time of release. Lorenc said attacks were already happening outside.
At 10 p.m. on Oct. 21, PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 were released under the revised schedule.
OpenAI framework had already anticipated this kind of trigger
OpenAI’s framework includes a condition stating that timelines should be reassessed if real-world attacks emerge, information leaks, or a public patch would reveal additional details. PHP’s decision to move the release up by one day matched that condition.
At the end of its article, OpenAI asked the community for feedback on whether coordinated disclosure should notify participants in stages or notify a broader group at once, and how to weigh coverage against the risk of leaks.
The PHP case now stands as a live example of that question. OpenAI’s article did not mention the leak itself, Calif’s video, or Chainguard’s early release. Calif is a partner in the Patch the Planet program.
In practical terms, the leak changed the timetable, not the required response from website operators: update to the released versions.