PHP Foundation forced to advance security patch by one day after Hacker News user leaks critical RCE details

A Hacker News user known as petecooper has compromised the embargo of two critical PHP security issues, leading to a major impact on the scheduled disclosure coordination process. Because of this leak, PHP Foundation had to accelerate their announcement to be released one day earlier. They had to do this in order to handle the premature leaks of security flaws. This incident underscores the fragility of security embargos and the impact of misinformation related to disclosure schedule.

Hacker News user petecooper admits to leaking two critical PHP vulnerabilities before the coordinated disclosure embargo, forcing the PHP Foundation to accelerate their announcement by one day.

The two security vulnerabilities, specifically CVE-2026-109618 and CVE-2026-109619, are classified as high severity vulnerability (9.2). They are related to the PHP runtime environment which powers a large portion of internet websites. The leak of these security issues comes earlier than the scheduled release date. Because of that, there are developers and users that are unable to obtain the necessary patches while the vulnerability is still being exposed.

The user petecooper explains that the leak happened because they were misled by their contacts who told them there is no embargo. They made an apology to security community for the extra work created and accepts full responsibility for their actions. The PHP Foundation further identified another entity, Chainguard, who has compromised the embargo by more than 6 hours. They have further worsened the situation.

Both of these vulnerabilities were found through AI tools. It is a remarkable occurrence for artificial intelligence to identify long-lasting code bugs. This is a great testament to the rising significance of automated tools in the realm of software security research. This event is a good reminder for security researchers to double-check their disclosure guidelines before they share sensitive information.