The classifier judged this item not relevant to AI security, so it is left out of lists, feeds, the API and dataset releases. If that is wrong, report a correction on this page.
InfoNews
PHP2Shell exposes the weakness in coordinated vulnerability disclosure
- Published
- Record updated
Summary
The PHP Foundation says Chainguard broke a coordinated embargo on two PHP flaws, CVE-2026-109618 and CVE-2026-109619, which could allow remote code execution. Chainguard published built images with the fix on October 21 at 07:41 UTC, about six hours before the agreed release time. The PHP project then released its patches early, on October 21 at 14:00 UTC.
Mitigation
Fixes were released by the PHP project on October 21, 2026 at 14:00 UTC, and distributors such as Chainguard shipped built images containing the fix.