How the disclosure broke
The plan was 22 October at 14:00 UTC. From about 15:00 UTC on 20 October the CVE IDs were loose with a wrong score; by 19:30 the project had pre-announced a release a day early; by 20:00 one of the reporters had published a demonstration video; by 23:00 mitigation advice was going to critical-infrastructure providers; by 02:00 on the 21st Amazon was seeing proof-of-concept attempts; by 03:02 Cloudflare's rules were live; by 07:41 Chainguard had shipped patched images; by 08:36 a sensor network had its first hit. The release went out at 13:34 UTC. Every one of those times is from a party's own account, and the parties disagree on what was leaked and by whom.
| When (UTC) | What | Time is | Sources |
|---|---|---|---|
| 2026-10-17 | An exploit attempt from an anonymisation-network IP hits an Amazon MadPot honeypot. As Amazon's CISO told The Hacker News; no primary Amazon post found. | stated | THN |
| 2026-10-20 | Swiss BACS posts a warning (home-page teaser dated 20 October; the page itself now says 21 October). | inferred | Swiss BACS BACS |
| 2026-10-20 | Qualys publishes on the pre-announcement. | stated | Qualys |
| 2026-10-20 15:00 UTC | The two CVE IDs begin circulating on forums and social media with a wrong release time and a wrong CVSS of 10.0. Per Daubois: an anonymous Hacker News post, then screenshots, a 'PHP2Shell tool' screenshot credited to Calif.io, a short exploitation video, and watchTowr posting both CVE numbers. 'around 15:00 UTC' per the Foundation. | stated | PHP Foundation Daubois |
| 2026-10-20 19:30 UTC | php.net publishes the pre-announcement: release moved to 21 October 14:00 UTC, two critical vulnerabilities, CVSS v4.0 9.2, 'we reserve the right to release earlier'. 19:30 UTC per the Foundation; the php.net feed says 20:32 UTC; oss-security relayed it at 20:22:51 UTC. | disputed | PHP Foundation oss-security php.net |
| 2026-10-20 20:00 UTC | Calif 'mistakenly published a video' showing its proof of concept against several targets; copies circulate after it is deleted. 'around 20:00 UTC'. Calif's page does not mention it. | stated | PHP Foundation PHP Foundation |
| 2026-10-20 20:22:51 UTC | Alan Coopersmith relays the php.net pre-announcement to oss-security. | stated | oss-security |
| 2026-10-20 23:00 UTC | The PHP project starts giving mitigation advice to a few critical-infrastructure providers; it 'may have leaked as well'. | stated | PHP Foundation |
| 2026-10-21 02:00 UTC | Amazon sees proof-of-concept attempts, then six hours of attempts from anonymised infrastructure. | stated | THN |
| 2026-10-21 07:41 UTC | Chainguard publishes built images containing the fix, 'more than six hours before the coordinated release'. Chainguard reportedly denies leaking; that article is blocked. | stated | PHP Foundation Techzine |
| 2026-10-21 07:43 UTC | Cloudflare's CTO reports early attacks emerging, before the release. Second-hand; the post itself is not captured. | stated | Insurance Business SecurityWeek |
| 2026-10-21 08:36 UTC | ELLIO records its first sensor hit. | stated | THN PHP Foundation |
| 2026-10-21 13:30 UTC | CERT-EU's stated release time for the PHP fixes. Differs from the planned 14:00 UTC and from the 13:35 UTC tags. | stated | CERT-EU |
| 2026-10-21 13:32 UTC | Wiz posts 'BREAKING ... #PHP2SHELL ... impacting 70% of the Internet', 28 minutes before the planned release; the thread still says 'Apply the Oct 22 security release'. | stated | Wiz on X |
| 2026-10-21 13:34:13 UTC | GHSA-6wmf-4rv5-p3rp (CVE-2026-109619) and, twelve seconds later, GHSA-w8hw-w9fx-j79w (CVE-2026-109618) are published by bukka. | stated | PHP PHP |
| 2026-10-21 13:35:38 UTC | Signed tags php-8.5.12, php-8.4.27, php-8.3.36 and php-8.2.35 are created. | stated | php-src |
| 2026-10-21 13:48:34 UTC | The CVE record for CVE-2026-109618 is published; CVE-2026-109619 follows at 13:54:43Z. | stated | CVE record CVE record |
| 2026-10-21 14:00 UTC | The planned release time. php.net's advisory 'Critical remote code execution vulnerabilities, update now' and the four release posts go up. | stated | php.net oss-security Daubois |
| 2026-10-21 14:04 UTC | OpenAI posts: models 'helped researchers ... discover critical security flaws in PHP ... used to run an estimated 70% of websites'. An X Community Note later disputes OpenAI's role. | stated | OpenAI on X |
| 2026-10-21 14:06:22 UTC | The fix commit enters the public php-src branches (commit timestamp); merged into 8.3 at 14:12, 8.4 at 14:27 and 8.5 at 14:30 UTC. | stated | php/php-src , read from a clone |
| 2026-10-21 14:06:46 UTC | GitHub release php-8.5.12 is published by adoy. | stated | php-src |
| 2026-10-21 14:17:09 UTC | NVD publishes both CVEs with the CNA's CVSS v4.0 9.2 and no NIST score. | stated | NVD NVD |
| 2026-10-21 14:41:54 UTC | Jakub Zelenka announces CVE-2026-109618 on oss-security; CVE-2026-109619 at 14:44:06Z. | stated | oss-security oss-security |
Three accounts of what leaked
- The PHP Foundation: the CVE IDs, a wrong release time and a wrong CVSS;
No technical details leaked.
Then Calif's video, then possibly the mitigation advice, then Chainguard's images. - Alexandre Daubois (PHP security team, writing personally): an anonymous Hacker News post citing a reliable source, screenshots of it, a screenshot of the
PHP2Shell tool
credited to Calif.ioalongside the advisory
, a short exploitation video, and watchTowr confirming both CVE numbers in public. - The Hacker News:
details about the CVE identifiers and a proof-of-concept (PoC) exploit leaked ahead of time
, and Amazon's evidence that somebody was trying an exploit four days before any of this.
Calif's own write-up has a timeline that ends October 21 Patched versions released
and does not mention a leak, a deleted video, or the Foundation's account. Chainguard's reply is behind a bot challenge; the search snippet says it does not dispute the time and denies leaking. The vault records both blocks.
The claims on the leak and on timing
| Claim | Who says it | Status | Primary | Sources |
|---|---|---|---|---|
| On 20 October at about 15:00 UTC the two CVE IDs began circulating on forums and social media with a wrong release time and a wrong CVSS score; no technical details leaked Primary party. The Foundation does not say who or where. | PHP Foundation | reported | 2/2 | PHP Foundation PHP Foundation |
| The leak started with an anonymous Hacker News post citing a reliable source, which came down after screenshots spread; a screenshot of the 'PHP2Shell tool' credited to Calif.io and a short exploitation video also went up and came down Contradicts the Foundation's 'no technical details leaked' and The Hacker News's 'a proof-of-concept exploit leaked'. No copy of the post, screenshot or video is in the vault. | Alexandre Daubois (PHP security team, personal blog) | reported | 0/1 | Daubois |
| watchTowr confirmed in public that the bugs were real and posted both CVE numbers before the release | Daubois; CERT-EU lists a watchTowr X post among public reports | reported | 1/2 | Daubois CERT-EU |
| Calif mistakenly published a video around 20:00 UTC on 20 October showing its proof of concept against a number of targets; copies circulated and 'contributed to accelerated development of various PoCs' Calif's own page does not mention a leak or a deleted video; it embeds two demo videos. Whether one of them is the deleted video is unknown. | PHP Foundation | reported | 3/4 | PHP Foundation PHP Foundation BBC News Calif |
| Mitigation advice given to a few critical-infrastructure providers from about 23:00 UTC on 20 October may have leaked | PHP Foundation | reported | 1/1 | PHP Foundation |
| Chainguard unilaterally broke the embargo on 21 October at 07:41 UTC by publishing built images containing the fix Dan Lorenc (via The Register): 'I made the call to get these out early when exploits hit in the wild'; several unnamed vendors had reported exploits; Chainguard's honeypots trapped IPs; a researcher warned the company on the Friday and its team then found the bugs independently with an AI harness. No evidence published. The PHP security team found no functional exploit by release time. | PHP Foundation; Chainguard's CEO accepts the time and denies leaking | disputed | 1/3 | PHP Foundation The Register Feross Aboukhadijeh on X on X |
| The release moved forward from 22 October 14:00 UTC to 21 October 14:00 UTC because of the leak The php.net ChangeLog still dates all four releases 22 October. Wiz's X thread still says 22 October. | PHP Foundation; php.net pre-announcement; Wiz thread ('Apply the Oct 22 security release') | confirmed | 4/4 | PHP Foundation oss-security Wiz on X php.net |
| The flaws were disclosed on 22 October 2026 Primary sources put the release at 21 October: GHSAs 13:34Z, tags 13:35Z, CVE records 13:48Z and 13:54Z, GitHub release 14:06Z. | BBC framing (UK morning coverage) | contradicted | 2/3 | BBC News php.net php-src |
| The fixes were released at 14:00 UTC on 21 October CERT-EU says 13:30 UTC; the tags and advisories are stamped 13:34 to 13:35 UTC; the GitHub release 14:06 UTC; the php.net feed entries carry 00:05 to 00:35 UTC, which are authoring times, not publication times. | php.net pre-announcement; Daubois; CERT-FR (16:00 Paris) | disputed | 7/8 | oss-security Daubois CERT-FR CERT-EU php-src PHP php-src php.net |
| The pre-announcement was published at 19:30 UTC on 20 October The php.net feed says 20:32 UTC; oss-security relayed it at 20:22:51 UTC, so it was public by then. | PHP Foundation | disputed | 3/3 | PHP Foundation oss-security php.net |
Counted from the repository, not from a page. Five authors; 389 files; 10,689 insertions. | php/php-src commit 3584a98bd, read from a clone | confirmed | 2/2 | php/php-src , read from a clone php-src |