PHP blames supply chain security biz Chainguard for putting huge chunks of the web at risk

PHP maintainers say Chainguard broke an embargo by publishing fixed software images more than six hours before planned disclosure of two critical vulnerabilities. They argue that attackers could study the fixes while most PHP users were still waiting for patches, putting servers at risk; PHP powers a large share of the public web.

The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, can let unauthenticated attackers run code on affected servers. After rumours about the bugs circulated on Tuesday, PHP moved its disclosure forward by a day. Chainguard CEO Dan Lorenc disputes that his company leaked information: he says it independently found the vulnerabilities, helped test patches, and shipped fixes after reports of proof-of-concept code and possible exploitation emerged.