PHP supply chain dispute follows early release of fixes
Maintainers accused Chainguard of breaking an embargo by publishing images containing security fixes more than six hours before a coordinated release. The…
PHP maintainers say a security fix intended for a coordinated release reached the public early, creating a gap in which attackers could study the patch before other users could update. The PHP supply chain dispute centers on Chainguard, which the developers accused of breaking an embargo ahead of the disclosure of two critical vulnerabilities.
The flaws, collectively called PHP2shell, affect servers running PHP and could let an unauthenticated attacker execute code. PHP developers said they moved the disclosure forward after rumors about the vulnerabilities began circulating online, but argued that Chainguard’s publication of fixed images came more than six hours before the planned release.
PHP says fix images appeared before disclosure
In a blog post published on Wednesday, PHP maintainers said two CVE identifiers began circulating on online forums and social media around 15:00 UTC on Tuesday. The posts included incorrect information about the release time and severity rating, they said, though no technical details had leaked at that point.
The rumors prompted maintainers to warn users that critical flaws were coming and bring the planned disclosure forward by one day, from Thursday to Wednesday. The PHP Foundation said distributors were still preparing packages, so an immediate release could have left users without a straightforward way to install the fix.
“Moving the release forward by one day was the best compromise between acting quickly, giving people time to prepare, and making sure everyone had a simple update path when the vulnerabilities were disclosed,” the PHP Foundation blog said.
The developers said Calif later mistakenly published a video showing a proof-of-concept exploit, along with limited information about the bugs. PHP’s blog also said mitigation advice shared with some critical infrastructure providers may have leaked. It did not identify those providers.
The maintainers said Chainguard published built images containing the fix at 07:41 UTC on October 21, more than six hours before the coordinated release. Distributors had received patches ahead of disclosure so customers could update once the vulnerabilities became public, according to the blog.
“Any attacker could now study the fix in binary form while every other PHP user was still waiting for the release,” the maintainers wrote. They said the early publication disregarded weeks of coordination among the parties involved.
Chainguard CEO says company found flaws independently
Chainguard CEO Dan Lorenc did not dispute the timeline when speaking with The Register on Wednesday, but rejected the accusation that his company leaked the vulnerabilities. “didn't leak,” Lorenc said.
He told the publication Chainguard learned on Friday that something was coming in PHP, through one of the researchers who found the bugs. Later that night, Lorenc and his team used the company’s AI harness and a frontier model to independently find the same memory-corruption vulnerabilities, he said.
In a subsequent LinkedIn post, Lorenc said the search began with a “basic prompt of ‘find bad vulnerabilities in PHP,’”. Chainguard began working with PHP maintainers on Saturday, confirmed that some of its findings matched the reported bugs, and helped with the response, The Register reported.
The vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619. PHP developers credited researchers at Calif, OpenAI and Wiz with finding the security holes between August and September, and said all three companies used AI models in their research.
The dispute matters beyond the companies involved because PHP powers a large part of the public web, according to The Register. For site operators, the competing accounts underscore a practical issue in coordinated security releases: the fix is not enough if users cannot obtain it promptly, while early access to patch details can expose systems that have not yet updated.
Chainguard’s Lorenc told The Register that his company “didn't leak.”
Source: theregister.com
