PHP moved up disclosure of two critical flaws after leak disrupted OpenAI-led coordination

PHP disclosed two critical vulnerabilities a day earlier than planned after details leaked online before the scheduled release. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and collectively referred to as PHP2Shell, were originally set for public release at 10 p.m. UTC+8 on Oct. 22, but information began circulating on forums and social platforms around 11 p.m. on Oct. 20. PHP then shifted the release to 10 p.m. on Oct. 21. OpenAI said it had spent roughly two months leading a coordinated response involving maintainers, researchers and security vendors. The process began after Calif audited PHP under OpenAI’s Patch the Planet program on July 30, and both Calif and OpenAI reported the same root cause on Aug. 11. A patch pull request was opened on Sept. 25 and, according to PHP Foundation member Alexandre Daubois, touched 390 files. After the leak, several additional incidents added to the dispute. Daubois said screenshots and posts spread on Hacker News, X and Mastodon. Calif was also said to have accidentally posted a video showing a proof-of-concept attack against multiple targets. Later, Chainguard released patched images more than six hours ahead of the coordination schedule. The PHP Foundation called that a unilateral embargo break, while Chainguard CEO Dan Lorenc said he chose to release early because attacks were happening in real environments. PHP Foundation said it had not seen a usable exploit by release time.