Two critical vulnerabilities discovered in the widely-used PHP programming language have shaken up enterprises, and the ramifications will take some time to truly understand. But one of the lesser-known stories centers around disclosure.
According to The PHP Foundation, several organizations had agreed to a coordinated release detailing the critical flaws and mitigation actions, but cybersecurity firm Chainguard “unlaterally” broke this embargo. This prompted the PHP project to release its patches early, but also allowed attackers to study the fix in binary form and craft proofs-of-concept (PoCs) for exploits before defenders had a chance to update their systems.
But some, including AWS and Cloudflare, contend that active exploits began hours, even days before the disclosure.
By some estimates, there have since been millions of attempts to abuse the 9.2-severity-rated bugs, collectively known as PHP2Shell. Many organizations, including government bodies, have reacted by taking their websites offline altogether.
“Frankly, the disclosure story is more interesting than the bugs themselves,” said Frank Dickson of Dickson Research. “Embargoes matter. This one was nearly impossible to keep.”
The messy disclosure
CVE-2026-109618 and CVE-2026-109619 could allow attackers to launch remote code execution (RCE) attacks.
The PHP Foundation acknowledged that one of its contractors had discovered the first signs of the out-of-memory (OOM) problem behind CVE-2026-109618 as far back as 2024, but “no concrete vectors” were found, and other issues with “clear impact” overshadowed its concerns about the flaw.
Deep research into the problem didn’t occur until July 30, 2026, after the Foundation got the PHP project into OpenAI’s Patch the Planet program. Researchers from Calif, OpenAI, and Google Cloud’s Wiz “made the full impact of the OOM problem clear,” and fixing it became top priority.
Once researchers developed patches, distributors, including Chainguard, received them in advance so their users could update “the moment the vulnerabilities were disclosed,” the Foundation said. It set an embargo for October 22 at 14:00 UTC.
That coordinated disclosure appeared to work well until two days prior to the embargo lifting, the Foundation explained. On October 20, around 15:00 UTC, the two CVE IDs began circulating online, although no technical details were leaked. The PHP project brought its pre-announcement forward and published it at 19:30 UTC. It also moved the release of fixes from October 22, 14:00 UTC, to October 21, 14:00 UTC.
The advancement of the pre-announcement’s timing led cybersecurity company Calif to “mistakenly” publish a video showing a PoC exploit against numerous targets. It also revealed “limited” details about the flaws. The video was subsequently deleted, but it had already begun circulating on social media.
Then, on October 21 at 07:41 UTC, Chainguard published built images containing the fix. This was roughly six hours before the agreed-upon release time, and “disregarded weeks of work by many parties toward a coordinated disclosure,” the PHP Foundation alleged.
Eighteen hours after the pre-release, on October 21, 14:00 UTC, the PHP project made the patches public. This was 24 hours earlier than originally planned.
The Foundation explained that distributors were still packaging the fix, so releasing it sooner would have left many users without an easy way to update. “Moving the release forward by one day was the best compromise between acting quickly, giving people time to prepare, and making sure everyone had a simple update path when the vulnerabilities were disclosed.”
Chainguard CEO Dan Lorenc fired back against the Foundation’s criticism, saying that he followed disclosure process guidelines for releasing after uncovering evidence of active exploits. “This decision was based on how easily we were able to independently discover the vulnerability and build an exploit, how much information was already out there on the coming vulnerabilities and fixes, and the evidence shared on active exploits in the wild,” he wrote in a LinkedIn post.
Indeed, Cloudflare CEO Matthew Prince said his company saw “thousands” of attempts to exploit PHP2Shell 10 hours before the public announcement. That jumped to “tens of thousands in the 45 minutes post announcement, hundreds of thousands within two hours, and millions now,” he said.
And AWS claims that at least one exploit attempt occurred four days before public disclosure, on October 17. This attempt originated from an IP address associated with a commercial anonymization network, according to AWS CISO CJ Moses, indicating that it was conducted by a threat actor, “though it remains unclear how the actor acquired exploit information prior to disclosure.”
Keeping secrets is hard, but it’s still the right model
While there seem to have been various leaks, that doesn’t excuse Chainguard,
[…]
Content was trimmed to protect the source. Please visit the original article for the full text.
Read the original article:
PHP2Shell exposes the weakness in coordinated vulnerability disclosure