PHP blames supply chain security biz Chainguard for putting huge chunks of the web at risk

Live updates

1. 1h ago

   PHP Blames Chainguard for Early Disclosure of PHP2Shell Bugs

   PHP maintainers have accused software supply chain security firm Chainguard of irresponsibly disclosing critical bugs ahead of an official coordinated release. The PHP2Shell vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, affect a vast portion of the internet and prompted emergency patches from PHP developers. Cloudflare has deployed protections against the flaw, and the NSA has recommended critical patches. Meanwhile, Chainguard's CEO defended the early disclosure by citing a lack of active exploits at the time.

   Why it matters

   The disclosure dispute centers on two critical remote code execution vulnerabilities that left significant parts of the web exposed. PHP maintainers published details about how researchers from Calif, OpenAI, and Wiz discovered the security holes, which led to a scramble for fixes across the cybersecurity industry. Unresolved concerns remain over the security of legacy systems that lack immediate updates.

   What is confirmed

   • PHP maintainers accused Chainguard of breaking an embargo on two critical PHP vulnerabilities collectively called PHP2shell.
   • The vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619.
   • Researchers at Calif, OpenAI, and Wiz found the security holes between August and September.
   • Cloudflare deployed protections against the php2shell vulnerability.
   • The NSA issued an advisory recommending critical patches for PHP vulnerabilities.

   Still unconfirmed

   • Threat hunters predict the exploitation of vulnerable legacy systems without security fixes will be severe.

   What to watch next

   • Evidence of active exploits targeting the PHP2Shell vulnerabilities in the wild
   • Official updates on the total scope of exploitation across legacy systems
   Sources used for this update (11)

   1. wiz.io — PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet
   2. Cloudflare Blog — Cloudflare deploys protections against php2shell vulnerability
   3. The Register — PHP blames supply chain security biz Chainguard for putting huge chunks of the web at risk
   4. The Economist — Is the internet still safe?
   5. National Security Agency (.gov) — NSA Advisory: Critical Patches Recommended for PHP Vulnerabilities
   6. www.businessinsider.com — Inside the cyber flaw scramble that brought the AI threat to life
   7. article.wn.com — PHP blames supply chain security biz Chainguard for putting ...
   8. meridian48.com — PHP Blames Chainguard for Supply Chain Security Risk
   9. daily.dev — PHP blames supply chain security biz Chainguard for putting ...
   10. forums.theregister.com — PHP blames supply chain security biz Chainguard for putting ...
   11. securityshelf.com — PHP blames supply chain security biz Chainguard for putting ...
   confidence 100%