Hacker News user breaks PHP security silence

One early post changed the timeline for two major security fixes.

A Hacker News user named petecooper shared details of two critical PHP vulnerabilities before the planned disclosure window closed. The user later issued a public apology. They stated they did not know a restriction existed. The post highlighted two specific flaws tracked as CVE-2026-109618 and CVE-2026-109619. Both issues are rated 9.2 in severity. They allow for remote code execution. The PHP Foundation had planned a controlled release. This approach gives affected sites time to patch. The early post disrupted that plan.

Petecooper said they shared the information to warn others. The user follows the four-week PHP release cycle closely. They wanted to signal urgency. Petecooper described themselves as a self-employed consultant. They also run a mental health non-profit alone. The user claimed no affiliation with the involved organizations. In their statement, they acknowledged the impact on the schedule. They admitted the post created extra workload. They took full responsibility for the action. They said causing side effects was never the goal. Petecooper noted their contact said there was no embargo. That contact’s own source made the same claim.

The leak was not the only source of early information. Several other posts circulated on social media. These posts pushed the PHP Foundation to act faster. The foundation moved its announcement forward by one day. They also identified Chainguard as another source. Chainguard broke the embargo by more than six hours. This added to the pressure on the timeline. The foundation had to coordinate a quicker response. The goal remained to inform the public while keeping the chaos manageable.

Dan Lorenc is the co-founder and CEO of Chainguard. He defended the decision on LinkedIn. Lorenc said he spoke with several other researchers first. Once the fix became public, he acted quickly. He notified the wider group rather than just his customers. This approach aimed to ensure broad awareness. It was a calculated risk. The company wanted to be transparent after the fix was available. The timing was tight but intentional.

The two flaws are bugs in the PHP runtime itself. Researchers found them using AI tools. They were not the result of attacks by rogue AI. The discovery highlights a new trend in security. AI tools can help researchers find hidden issues. They can also help malicious actors. These tools may uncover vulnerabilities that have sat in code for years. Some bugs might have existed for decades. Each discovery starts a race. Developers must build and deploy a fix quickly. Attackers try to exploit the gap. This dynamic changes how security teams work.

The incident shows how information spreads today. One post can shift a careful plan. The PHP Foundation had to adapt in real time. The user who posted the details felt they were doing the right thing. They wanted to help the community stay safe. The outcome was a faster public release. The bugs are now widely known. Patches are available. The story ends with a lesson in timing. It also shows the power of individual voices in tech. The foundation moved ahead. The user apologized. The process continues.