PHP fixes two critical flaws as maintainers and Chainguard dispute early release
PHP moved its security release forward after vulnerability identifiers circulated online. Its maintainers say Chainguard published patched images ahead of the coordinated release; Chainguard’s CEO says reports of exploitation prompted the decision.
The PHP project released fixes for two critical vulnerabilities on October 21, 2026, after moving its planned security release forward by a day. The flaws can allow an unauthenticated attacker to run code on servers under the right conditions, making the updates urgent for people running affected PHP versions.
The updates are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The PHP Foundation identifies the flaws as CVE-2026-109618 and CVE-2026-109619, each with a severity score of 9.2. It urges PHP users to update and points them to the PHP release announcement for technical details and instructions.
Why PHP moved its security release forward
The Foundation said the two vulnerability identifiers began circulating online on October 20 at about 15:00 UTC, alongside an incorrect release time and a score of 10.0. It said technical details had not leaked at that point. PHP issued a pre-announcement at 19:30 UTC and moved the fixes from October 22 at 14:00 UTC to October 21 at 14:00 UTC. Distributors were still packaging the fixes, the Foundation said, so an immediate release would have left some users without a straightforward update path.
One flaw involves memory corruption when a request reaches PHP’s memory limit at a critical moment. The other can leave stale internal state after a fatal error; the Foundation said a reporter demonstrated remote code execution against an application running Apache with mod_php. Both flaws involve conditions that matter to server operators assessing their exposure.
Why Chainguard published patched images early
The Foundation said Chainguard published built images containing the fixes at 07:41 UTC on October 21, more than six hours before the coordinated release, after receiving the patch in advance. Chainguard chief executive Dan Lorenc disputed that his company leaked the vulnerabilities. He told The Register that Chainguard had learned something was coming in PHP on Friday, independently found the same flaws and began working with maintainers on Saturday to test patches.
Lorenc told The Register he decided late Tuesday to ship fixes after seeing proof-of-concept posts and hearing other security vendors report real-world exploitation. ‘People were getting hit in advance,’ he said. The Foundation said its security team monitored the posts but had not identified a functional exploit at the time of public disclosure. Whether attacks occurred remains unresolved between those accounts.
The Foundation said it is changing how its leadership handles serious vulnerabilities with difficult fixes and prioritising faster resolution of similarly complex cases.
Read in depth: Technology
Airbnb to bar hosts from requiring guests to wash dishes or take rubbish off-site
The revised house rules apply to reservations booked from November 20. Hosts can still ask guests to put dishes in the sink and sort rubbish into indoor bins.
Astronomers discover first documented green star 280 light-years away
White dwarf WD J1330+6435 glows chartreuse after planetary debris enriches its atmosphere with sodium, changing how it absorbs light.
Sources and context
- PHP blames supply chain security biz Chainguard for putting huge chunks of the web at riskThe Register
- Today's PHP Security Release, and How We're Strengthening PHP SecurityThe PHP Foundation
AI-assisted article checked against the listed sources. NewsJaws did not conduct interviews or attend the reported events.