Today's PHP Security Release, and How We're Strengthening PHP Security

PHP Foundation blog, 21 Oct 2026: the leak and the discovery timeline (collector-researchers)

Captured for the researchers/leak beat; the advisory collectors may hold their own copy.

Discovery (verbatim)

• 2024: "While fixing one of the issues Quarkslab reported, a PHP core developer contracted by the PHP Foundation found the first signs of the OOM problem behind CVE-2026-109618. In 2024, a potential exploit for the OOM problem was theorized, but no concrete vectors were found".
• "The PHP Foundation got the PHP project into the Patch the Planet program, as part of which security firm Calif began an audit of PHP on July 30th, 2026. On August 11th researcher Ryan A at Calif reported an unconditional remote code execution with the same root cause as the OOM problem we had found in 2024. OpenAI independently reported the same root cause on the same day, followed by further attack vectors from OpenAI on September 18th and from Wiz on August 24th. More recently, Trail of Bits has also been auditing PHP."
• Tools: "Earlier this year, we worked with Alpha-Omega to scan PHP with Anthropic's Claude Mythos ... OpenAI's Daybreak Red for validating reports and exploits".
• Thanks "OpenAI Codex Security, especially Amy Burnett".

Leak (verbatim, section "Leak and disrupted disclosure")

• "The coordinated disclosure of these vulnerabilities worked well until 2 days ahead of the targeted release date."
• "On Tuesday, October 20th, at around 15:00 UTC, the two CVE IDs began circulating on online forums and social media. They came with a wrong release time and a wrong CVSS score of 10.0 (the actual score is 9.2). No technical details leaked." Pre-announcement moved to 19:30 UTC; release moved from Oct 22 14:00 UTC to Oct 21 14:00 UTC.
• "As a result of the leak and pre-announcement around 20:00 UTC, Calif, one of the security firms that had reported the issues, mistakenly published a video. It showed their proof of concept working against a number of targets and revealed a few additional, though limited, details about the vulnerabilities. Copies of the deleted video started circulating on social media soon after. The video contributed to accelerated development of various PoCs".
• "Mitigation advice we started providing to a few critical infrastructure providers around Oct 20th 23:00 UTC, may have leaked as well."
• "did not identify any functional exploits at the time of release/public disclosure."
• "On October 21st at 07:41 UTC ... Chainguard unilaterally broke the embargo and published built images containing the fix."

Odd / follow up

• Does not say WHO first leaked the CVE IDs, nor where. Daubois (same team) points to an anonymous Hacker News post.
• Text capture includes reader comments under the post (third-party; e.g. a commenter claims "sansec.io leaked one of the attack vectors ... in their page's metadata"; another notes ELLIO's first in-the-wild hit 55 min after Chainguard). Unverified.