The classifier judged this item not relevant to AI security, so it is left out of lists, feeds, the API and dataset releases. If that is wrong, report a correction on this page.
PHP Foundation Says Chainguard Broke Security Embargo Ahead of Emergency Patches
- Published
- Record updated
Summary
The PHP Foundation says Chainguard broke a coordinated security embargo by publishing patched PHP container images more than six hours before the scheduled release on October 21. The Foundation argues this let attackers study the fix in binary form while other distributors and users were still waiting, and it describes a disclosure process also disrupted by leaked CVE identifiers and an accidentally published exploit demonstration. The patches address CVE-2026-109618 and CVE-2026-109619, two critical remote code execution vulnerabilities in PHP.
Mitigation
Fixed by the emergency PHP patches for CVE-2026-109618 and CVE-2026-109619. Chainguard published patched PHP container images early, on October 21 at 07:41 UTC.