Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?

Risks / R02

R02: The coordinated disclosure broke before the fix was ready

Because the secret was held by four finders, a coalition, critical-infrastructure providers and image builders at once, it leaked a day early, resulting in a release moved forward by 24 hours and defenders starting the race with attackers already told where to look.

Rating 20 critical · Likelihood 5 Happening · Impact 4 Major · Kind Disclosure process · Acceptance not recorded

Basis. It happened: the release moved from 22 to 21 October because of the leak.

The path

Told inWhere php2shell standsWhere php2shell stan…php2shell in perspectivephp2shell in perspec…Acted on bySecurity lead and AppSecSecurity lead and Ap…Story site agentStory site agentHistorianHistorianCarried byThe PHP security team (owner)The PHP security tea…The finders (source)The finders (source)Distributors and packagers (source)Distributors and pac…Organisations running PHP (bearer)Organisations runnin…Security lead and AppSec (bearer)Security lead and Ap…RiskR02 The coordinated disclosure broke before the fix was readyR02 The coordinated …Arises fromOne embargo shared by many partiesOne embargo shared b…VulnerabilityCVE-2026-109618CVE-2026-109618CVE-2026-109619CVE-2026-109619Fixed byA soft memory limit that no longer jumpsA soft memory limit …A hard limit that ends the process cleanlyA hard limit that en…An orderly unwind at the next safe pointAn orderly unwind at…Allocations that may fail instead of abortAllocations that may…Request globals reset so nothing survives a failureRequest globals rese…Bounded, deduplicated request parsingBounded, deduplicate…CodeZend/zend_alloc.cZend/zend_alloc.cZend/zend_execute_API.cZend/zend_execute_AP…Zend/zend_hash.cZend/zend_hash.cZend/zend_string.cZend/zend_string.cZend/zend_types.hZend/zend_types.hext/session/session.cext/session/session.…main/SAPI.cmain/SAPI.cmain/main.cmain/main.cmain/rfc1867.cmain/rfc1867.c
The risk sits in the middle. To its left, the stories that tell it, the roles and team members that act on it, and every stakeholder that carries part of it. To its right, what it arises from, the vulnerability behind that, the part of the fix that addresses it and the code the fix changed. Every line is an edge in the graph; every node is a link; hover for the full name. Vulnerabilities, stories and team members include those of the risk this one is part of; roles include those of the risks above and beneath it.

Who carries it

One risk, assigned to every stakeholder that carries part of it, with the part each plays.

StakeholderPartWhyIts register
The PHP security teamownerRan the embargo and moved the release.7 risks
The finderssourceFour parties held the details; one published a video by mistake.7 risks
Distributors and packagerssourceBuilt and, in one disputed case, published fixed images early.3 risks
Organisations running PHPbearerLost a day of preparation.26 risks
Security lead and AppSecbearerStarts the patch plan a day early, on leaked details.6 risks

The risks this one is made of

RiskRatingKindAssigned toControls
R02-1 The CVE IDs and the proof-of-concept video circulated before release20 criticalDisclosure processCalif source, The PHP security team owner, Edge, WAF and detection vendors treaterISO/IEC 29147 and 30111 29147:coordination, NIST CSF 2.0 ID.RA-08
R02-3 Patched builds published before the embargo lifted16 highSupply chainChainguard source, Distributors and packagers owner, The PHP security team regulatorISO/IEC 29147 and 30111 29147:coordination, Cyber Resilience Act Art.13, NIST CSF 2.0 GV.SC-05, OWASP Top 10s A03:2025
R02-2 Early mitigation advice to a few providers leaked9 mediumDisclosure processCritical infrastructure providers source, The PHP security team owner, Organisations running PHP bearerFIRST TLP 2.0 TLP:AMBER+STRICT, ISO/IEC 27001 A.5.14, ISO/IEC 29147 and 30111 29147:coordination

What it arises from

The evidence

ClaimStatusFact-checkSources
The release moved forward from 22 October 14:00 UTC to 21 October 14:00 UTC because of the leakconfirmedA4 CorroboratedPHP Foundation oss-security Wiz on X php.net
On 20 October at about 15:00 UTC the two CVE IDs began circulating on forums and social media with a wrong release time and a wrong CVSS score; no technical details leakedreportedA2 ReportedPHP Foundation PHP Foundation
Calif mistakenly published a video around 20:00 UTC on 20 October showing its proof of concept against a number of targets; copies circulated and 'contributed to accelerated development of various PoCs'reportedA3 EchoedPHP Foundation PHP Foundation BBC News Calif
Chainguard unilaterally broke the embargo on 21 October at 07:41 UTC by publishing built images containing the fixdisputedA2 ReportedPHP Foundation The Register Feross Aboukhadijeh on X on X
Mitigation advice given to a few critical-infrastructure providers from about 23:00 UTC on 20 October may have leakedreportedA2 ReportedPHP Foundation

Treatments

TreatmentStatusWhere
Move the release forward once the leak was confirmedin placeHow the coordinated disclosure broke

The standards that govern it

FrameworkControlWhat it asksFamily
ISO/IEC 29147 and 3011129147:coordinationCoordinating disclosure with other vendors and parties under embargoPractice and technique
NIS2Art.12Coordinated vulnerability disclosure and the European vulnerability databaseLaw and regulation
NIST CSF 2.0ID.RA-08Processes for receiving, analysing and responding to vulnerability disclosures are establishedFrameworks and control catalogues
FIRST TLP 2.0TLP:AMBER+STRICTLimited disclosure: recipients share only within their organisationPractice and technique

The stories that tell it

On this site: How the coordinated disclosure broke · The timeline, 2024 to the latest capture