PHP blames supply chain security biz Chainguard for putting huge chunks of the web at risk

If you run web servers, you need to immediately patch your PHP installations to avoid remote code execution.

PHP developers are accusing supply chain security firm Chainguard of prematurely disclosing critical vulnerabilities in the open-source scripting language, PHP. The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, allow unauthenticated attackers to execute code on servers. Researchers from OpenAI, Wiz, and Calif discovered these flaws between August and September, with all three using AI models. PHP maintainers planned to disclose the bugs on Thursday, but rumors and a "mistaken" proof-of-concept video released by Calif on Tuesday prompted an earlier, emergency patch release on Wednesday. PHP claims Chainguard, which received the patch in advance for its users, unilaterally broke the embargo on Wednesday morning by publishing built images containing the fix, allowing attackers to study the solution before the official announcement. Chainguard CEO Dan Lorenc stated that they released the fixes because evidence of active exploits in the wild was emerging, making coordinated disclosure less feasible.

This incident highlights the tension between rapid disclosure of critical vulnerabilities and the traditional model of coordinated vulnerability disclosure. Chainguard's actions, driven by the perception of active exploitation, suggest a shift towards prioritizing immediate mitigation over strict adherence to disclosure timelines, especially when AI accelerates exploit development. This approach could become more common as attackers leverage AI to find and weaponize vulnerabilities faster.

The controversy underscores the increasing role of AI in both discovering and exploiting software flaws. The fact that multiple researchers used AI to find these PHP bugs, and that Chainguard's CEO used an AI harness to independently find them, points to a future where AI-assisted vulnerability research and rapid patching become standard. This also implies that companies like Chainguard may increasingly act as rapid responders to emerging threats, even if it disrupts traditional disclosure processes.