AI Image
PHP blames supply chain security biz Chainguard for putting huge chunks of the web at risk
The Register • • world
Key Points:
- PHP developers have criticized Chainguard for prematurely disclosing critical PHP vulnerabilities known as PHP2shell, which were officially patched and disclosed by PHP maintainers shortly after.
- The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, allow unauthenticated remote code execution and affect all PHP versions released in the last decade, posing serious risks to the vast number of websites running PHP.
- Chainguard independently discovered the bugs using AI models and, amid rumors of leaks and active exploitation, decided to release fixes early to protect users, a move that disrupted the coordinated disclosure process.
- PHP maintainers and security researchers warn that these memory corruption flaws can be exploited remotely to take control of servers, emphasizing the urgency of immediate patching to prevent attacks.
- Chainguard’s CEO defended the early release decision, stating that rapid exploit development is now common once vulnerabilities are known, and highlighted ongoing attempts by threat actors from China and Russia to exploit these bugs.
