Two flaws, CVE-2026-109618 and CVE-2026-109619, collectively called PHP2shell, let an unauthenticated attacker run code on servers running PHP, the language behind a large part of the web. PHP fixed them on 21 October with versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, after researchers had found them between August and September using AI models.
Disclosure, planned for Thursday, was moved forward a day after CVE identifiers started circulating on forums and social media on Tuesday, along with wrong information about release timing and severity. According to the PHP Foundation, the move gave distributors time to package the fix. A few hours later, Calif mistakenly published a video with a proof-of-concept exploit.
Chainguard at the center of the dispute
The most contested part concerns Chainguard, a company that works on software supply chain security. The PHP Foundation says that at 07:41 UTC on 21 October, more than six hours before the coordinated release, Chainguard published built images containing the fix, letting attackers study it in binary form. CEO Dan Lorenc does not dispute the timeline but says his company "didn't leak": his team, using a frontier model, independently found the same flaws with a generic prompt. He argues that with attacks already underway, shipping the patches was consistent with a policy that allows exceptions when active exploitation is evident.
Exploits already circulating
Amazon Web Services says at least one actor tried to exploit the flaws on 17 October, four days before public disclosure, against a honeypot from an address routed through a commercial anonymization network. The research does not explain how the attacker obtained information before the announcement. In the hours that followed, more exploitation attempts came in from several sources.
Wiz, which reported one of the two flaws, notes the bug had sat in PHP for about two decades and that exploiting it required a very complex chain of steps. AI tools lowered that barrier: in Wiz's case, with help from Gemini and GPT models, a working exploit was developed in about a week.
Which systems are affected
Wiz says every PHP version released in the past decade is hit by at least one of the flaws, going back to 5.4. The first bug, CVE-2026-109618, concerns memory handling when a request reaches the memory limit at the wrong moment; on Apache with mod_php an attack can happen before any application code runs. The second, CVE-2026-109619, exploits global state left behind after a fatal error, letting a later request use memory that has already been freed. Both carry a CVSS score of 9.2.
For sites that cannot update immediately, several agencies, including the UK's NCSC and the NSA on its social channels, advised taking systems offline until the patch is installed. The Dutch and Finnish governments have already taken some sites down as a precaution, and several platforms, including 4chan, Wikipedia and DeviantArt, have had disruptions. For server operators, the advice is to update PHP through OS packages and check for web shells or modified files dating back to at least June.
What the disclosure dispute means
The episode tests coordinated disclosure, a model built on the time distributors need to prepare fixes. With models able to find and exploit flaws in hours, that window is shrinking. AWS's report makes the point that coordinated disclosure will have to speed up.
No comments yet. Be the first!