PHP Foundation Says Chainguard Broke Security Embargo Ahead of Emergency Patches

What it is

The PHP Foundation's postmortem, published October 21, 2026, says Chainguard published patched PHP container images at 07:41 UTC on October 21. That was more than six hours before the coordinated release of fixes for CVE-2026-109618 and CVE-2026-109619, two critical unauthenticated RCE flaws. The Foundation says attackers could study the fix in binary form while other PHP users and distributors were still waiting. The source for this document is Socket's report on that postmortem, not the postmortem itself.

Timeline

timeline
    title Disclosure breakdown
    Aug 11 : Calif and OpenAI report root cause
    Oct 20 15:00 UTC : CVE IDs leak
    Oct 20 19:30 UTC : PHP warning moved up
    Oct 20 20:00 UTC : Calif exploit video posted
    Oct 21 07:41 UTC : Chainguard images published
    Oct 21 14:00 UTC : Planned patch release

• The release had been moved from October 22 to October 21 after the leak, keeping the 14:00 UTC time.
• The leaked IDs carried a wrong release time and a wrong CVSS score of 10.0, with no technical details.
• Calif accidentally published a video of its exploits working against several targets. It was deleted, but copies spread. The Foundation says it exposed limited detail but sped up public PoC development.
• Mitigation guidance sent to some critical infrastructure providers around 23:00 UTC may also have leaked. The source of the CVE leak is not identified.

Root cause history

The out-of-memory problem behind CVE-2026-109618 first showed up in 2024, during work on a Quarkslab audit finding (organized through OSTIF, funded by the Sovereign Tech Agency). Candidate fixes risked broken compatibility, new denial-of-service risks, or changes to third-party extensions. Consensus decision-making stalled the work. It became top priority on August 11, 2026, when Calif reported an unconditional RCE with the same root cause. OpenAI independently reported that root cause the same day. Wiz and OpenAI later supplied more attack vectors.

What to do

The page gives no fixed PHP version numbers, commands or detections. Engineers should take patched versions from the PHP release announcement or their distributor. Two facts from the page bear on timing:

• Chainguard's patched images were public and free from 07:41 UTC on October 21.
• Cloudflare's Dane Knecht reported early attacks before the patches and said Cloudflare deployed temporary WAF protections.

For teams that receive embargoed patches, Chainguard's disclosure policy (updated September 22) allows shortened timelines for active exploitation, public details or other exceptional circumstances. It also promises to notify the reporter of timeline changes.

Caveats

• Chainguard CEO Dan Lorenc says several vendors reported in-the-wild exploits by Tuesday night. Lorenc named no vendors and gave no evidence.
• The Foundation inspected public PoCs and found no functional ones by release time. That does not rule out exploitation elsewhere.
• Knecht's report did not establish that any attack succeeded.
• Lorenc says the coordination group was notified immediately and apologized for the stress on maintainers. The Foundation calls the release unilateral. Chainguard's policy criteria do not show that PHP's maintainers authorized publication.
• Lorenc says Chainguard independently found the flaw using a frontier AI model after a Friday warning.
• Foundation figures: 15 CVEs published since July 1, and more than 100 reports that were invalid, duplicates or not reproducible. It is moving to majority decisions in its security team and asking dependent organizations to fund engine engineers.