Severity 9.2: The PHP bugs that broke the silence

The carefully planned silence around two critical security flaws in PHP was shattered early, leaving a major software foundation scrambling to adjust its schedule. The disruption stems from a Hacker News user who published details of the vulnerabilities before the agreed-upon disclosure window closed. This early release created immediate tension between the desire for transparency and the need to give developers time to patch their systems safely.

The user, known online as petecooper, issued a public apology on October 23, 2026. They explained that they shared the Common Vulnerabilities and Exposures (CVE) identifiers to alert others about the urgency of the situation. Petecooper stated they had no formal ties to the organizations involved in the fix. Instead, they described themselves as a self-employed consultant and the founder of a mental health non-profit. They claimed they believed there was no restriction on sharing the information because a contact had told them so.

In their statement, petecooper acknowledged the impact of their post on the coordinated disclosure schedule. They wrote that they took full responsibility for the additional workload created for the team managing the release. The user emphasized that causing these side effects was not their intention. They noted that their contact had also been told there was no embargo, suggesting a breakdown in communication among those who received the advance warning.

The two vulnerabilities in question are rated with a severity score of 9.2, indicating a high level of risk. They are remote code execution flaws that allow attackers to potentially take control of servers running PHP. The PHP Foundation had intended a controlled release to ensure that patches were widely available before the details became public knowledge. This strategy is designed to minimize the window of opportunity for malicious actors to exploit the bugs.

The early leak was not an isolated incident. Several other sources had already shared information about the flaws on social media and other platforms. This widespread early chatter forced the PHP Foundation to move its announcement forward by one day. The foundation also pointed out that Chainguard, a software company, broke the embargo by more than six hours before the official release date.

Dan Lorenc, the co-founder and CEO of Chainguard, defended the company's actions on LinkedIn. He explained that he spoke with several other researchers before making his move. Lorenc stated that once the fix was available to the public, he chose to notify his entire user group rather than just the company's direct customers. He argued that this approach served the broader community better.

These specific bugs exist within the PHP runtime itself and were discovered using artificial intelligence tools. They were not the result of an AI system acting independently or maliciously. However, the use of AI in finding these issues highlights a changing landscape in software security. These tools can help both researchers and attackers find weaknesses that may have remained hidden in widely used code for years or even decades.

The discovery of such flaws now turns into a race. Security teams must develop and deploy fixes quickly to stay ahead of potential exploits. As AI tools become more common in code analysis, the pressure to maintain tight embargoes and coordinate disclosures will likely increase. The incident with the 9.2 severity bugs serves as a reminder of how fragile the timeline for public security updates can be.