Hacker News User Apologizes After Early Leak of Critical PHP Vulnerabilities

The coordinated release of patches for two severe PHP flaws was disrupted when a Hacker News member shared details ahead of schedule. The incident has sparked a public apology and a broader conversation about security disclosure norms in the open-source community.

The user, known online as petecooper, stated they posted the information to warn peers about the urgency of the issues. They explained that they follow PHP's four-week release cycle and felt the matter required immediate attention. Petecooper described themselves as a self-employed consultant and the solo founder of a mental health non-profit, emphasizing they had no formal ties to the organizations involved.

In a detailed statement, the user acknowledged the impact of their actions on the coordinated disclosure timeline. They accepted full responsibility for the additional workload created for the team. Petecooper noted that their contact had indicated no embargo was in place, a claim that was also supported by that contact's own source.

The vulnerabilities in question are tracked as CVE-2026-109618 and CVE-2026-109619. Both are rated with a severity score of 9.2, classifying them as critical remote code execution flaws. The PHP Foundation had planned a controlled public release to allow time for patches. However, some recipients of the advance warning failed to pass along the embargo instructions, causing the news to spread earlier than intended.

Petecooper was not the only source of early information. Other leaks had already appeared on social media and various platforms. These additional disclosures pushed the PHP Foundation to move its announcement forward by one day. The foundation also identified that Chainguard broke the embargo by more than six hours.

Dan Lorenc, co-founder and CEO of Chainguard, defended his organization's decision on LinkedIn. He explained that he acted after consulting with several other researchers. Lorenc stated that once the fix was made public, he chose to notify the wider group rather than just the company's customers.

The two bugs exist within the PHP runtime itself and were discovered using AI tools. They were not the result of attacks by rogue AI systems. However, the use of such tools means both security researchers and malicious actors can uncover vulnerabilities that have remained hidden in widely used code for years or even decades. This dynamic turns each discovery into a race to develop and deploy a fix before the flaw can be exploited.

The incident highlights the challenges of managing security disclosures in an era where information travels quickly across multiple platforms. While the PHP Foundation moved quickly to adapt its schedule, the episode underscores the need for clear communication regarding embargoes. As AI tools become more prevalent in finding bugs, the pressure on developers to patch issues rapidly will only increase, making coordinated disclosure even more critical for global web security.