PHP blames supply chain security biz Chainguard for putting huge chunks of the web at risk

PHP developers have criticized supply chain security firm Chainguard for potentially exposing significant flaws in the open-source scripting language PHP before the planned official disclosure. Hours after releasing emergency patches for the vulnerabilities, known collectively as PHP2shell, PHP maintainers published a blog explaining how the bugs were found and fixed.

They credited researchers from Calif, OpenAI, and Wiz for discovering the security holes between August and September. All three companies stated they used AI models to identify the vulnerabilities, which are now recorded as CVE-2026-109618 and CVE-2026-109619. These flaws enable unauthenticated attackers to execute code on servers running PHP, posing a severe risk since PHP powers a substantial portion of the public web.

This adds irony to PHP's disclosure, which accuses Chainguard, a company aimed at securing software supply chains by hardening open-source code, for the chaotic disclosure. The issue began on Tuesday around 15:00 UTC when "two CVE IDs began circulating on online forums and social media," along with incorrect information about the release time and CVSS severity rating.

Despite this, PHP maintainers moved the planned disclosure forward a day, from Thursday to Wednesday, to give users time to prepare and ensure a simple update path. Just hours later, Calif mistakenly published a video showing a proof-of-concept exploit and additional, albeit limited, information about the bugs. Chaingguard then unilaterally broke the embargo on October 21st at 07:41 UTC, publishing built images containing the fix more than six hours before the coordinated release.

This action disregarded weeks of work by various parties toward a coordinated disclosure, according to PHP. Chainguard CEO Dan Lorenc spoke with The Register, denying that his company leaked information. He explained that Chainguard learned about the vulnerabilities on Friday from one of the researchers who found the bugs. Using Chainguard's AI harness and a frontier model, Lorenc and the team independently found the same memory corruption vulnerabilities.

He revealed that Chainguard began working with PHP maintainers on Saturday, confirmed that some of its findings matched the bug reports, and helped test the patches. However, the disclosure process spiraled after rumors about the vulnerabilities started circulating on social media and other security vendors reported real-world exploitation.

Lorenc claimed that they shipped the fixes and notified the PHP coordinated disclosure channel about their plans after observing others getting hit before the official disclosure.