The PHP Foundation details how it found and fixed the two flaws, and says it had to release patches a day early after the CVE IDs began circulating online

You must update your PHP installations immediately to patch two critical vulnerabilities.

The PHP Foundation has released security patches for multiple PHP versions (8.5.12, 8.4.27, 8.3.36, and 8.2.35) to address two critical remote code execution vulnerabilities. These flaws, CVE-2026-109618 and CVE-2026-109619, allow unauthenticated attackers to execute arbitrary code on servers by exploiting memory corruption or stale state issues within PHP's core memory management and error handling components. The vulnerabilities were discovered through a combination of external audits, AI-assisted research, and internal development, with significant contributions from security firms like Calif, OpenAI, and Wiz. The release was expedited and moved up a day after the CVE IDs began circulating online, disrupting the planned coordinated disclosure.

The PHP Foundation's response highlights a significant shift towards professionalizing PHP security, moving from a small group of core developers to a structured Ecosystem Security Team with dedicated security engineers and AI tools for vulnerability detection and validation. This increased investment, funded by organizations like the Sovereign Tech Agency, is crucial for addressing complex, deeply-rooted vulnerabilities that previously stalled due to resource and decision-making bottlenecks. The Foundation aims to implement new processes to ensure faster resolution of critical issues and improve consensus-driven decision-making within the security team.

The premature disclosure of these vulnerabilities, driven by leaks and a unilateral embargo break by Chainguard, underscores the ongoing challenges of coordinated vulnerability disclosure in an era of rapid information dissemination. This incident demonstrates the necessity for robust communication protocols and the potential risks when these are compromised, impacting the ability of distributors to prepare and deploy patches effectively. It also reinforces the growing role of AI in security research, both in finding vulnerabilities and in the race to develop proofs-of-concept.