PHP blames supply chain security biz Chainguard for putting huge chunks of the web at risk
Chainguard, a software supply chain security firm, inadvertently leaked critical vulnerabilities in PHP ahead of a planned coordinated disclosure. The vulnerabilities, CVE-2026-109618 and CVE-2026-109619, could allow unauthenticated remote code execution on PHP servers. The incident stemmed from Chainguard’s use of AI to identify the flaws, followed by an early disclosure that exposed the vulnerabilities to attackers before PHP maintainers could fully coordinate a release. While Chainguard claims it acted to mitigate harm, the leak has raised concerns about potential exploitation and the security of legacy PHP systems.
Summary written automatically in our own words from the original article, which belongs to its publisher and remains the reference. It may contain errors. Sources & data
Also covered by 13 other source(s)
- PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert
- PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP Flaws
- Critical Vulnerabilities in PHP Require Immediate Patching
- Critical PHP Vulnerability (CVE-2026-109618, CVE-2026-109619) [infocon yellow], (Wed, Oct 21st)
- PHP2Shell : deux failles critiques menacent les serveurs web
- PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge
- PHP devs publish critical bug fix as site owners warned: Pull 'em offline if you're unpatched
- Two critical RCEs in PHP core
- Critical RCE vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619)
- Widespread PHP Flaw May Cause Many Site Outages Today
- PHP2Shell Patches Land as First Exploitation Attempts Hit Sensors
- PHP says AI review of critical bugs first sparked alarm in August, but signs surfaced in 2024
- 'PHP2Shell' Bugs Signal Red Alert for Security Industry