FOSSWire
Search/
Linux Kernel & OS

PHP Foundation accuses Chainguard of breaking embargo on critical PHP2shell flaws

Brief written by the FOSSWire AI editor from The Register How we write

1 min read 2 reads

Key Takeaway

PHP maintainers say Chainguard published patched images six hours before coordinated disclosure, while Chainguard's CEO defends the decision citing active exploitation in the wild.

Summary

The PHP Foundation published a blog post accusing supply-chain security vendor Chainguard of unilaterally breaking an embargo on two critical remote-code-execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Chainguard CEO Dan Lorenc acknowledged shipping patched images early but stated the decision came after proof-of-concept exploits appeared on social media and other vendors reported active attacks. The bugs affect every PHP version back to 5.4 and were discovered by researchers at Calif, OpenAI, and Wiz using AI models.

How the PHP2shell disclosure unraveled

  • CVE-2026-109618: Out-of-memory corruption leading to RCE; on Apache with mod_php, an unauthenticated request can trigger this before any application code runs
  • CVE-2026-109619: Stale internal state from a fatal error at the wrong point, allowing a later request to reuse memory from a previous request
  • Both are memory corruption bugs; an attacker who can shape memory PHP trusts can hijack execution
  • Every PHP version released in the last decade (back to 5.4) is affected by at least one of the two flaws
  • Timeline: rumors with CVE IDs circulated Tuesday ~15:00 UTC; Calif published a PoC video hours later; Chainguard shipped fixes Tuesday night at 07:41 UTC, six hours before the coordinated Wednesday release

Why it matters

PHP runs an estimated 70 percent of websites globally, making unauthenticated RCE in the runtime itself one of the most consequential vulnerability classes possible. The disclosure dispute also highlights tension between coordinated disclosure norms and vendor policies that prioritize shipping fixes when exploitation is confirmed.

What to do

  • Update PHP to the latest patched version released by the PHP Foundation on Wednesday to fix CVE-2026-109618 and CVE-2026-109619.
  • If you run Apache with mod_php, prioritize patching because unauthenticated requests can trigger remote code execution before any application code runs.
  • Watch for signs of exploitation attempts, as Chainguard reported observing real-world attacks and honeypot hits from China and Russia on Wednesday.

Original reference: www.theregister.com →