A Hacker News user who shared news about the recent PHP vulnerabilities revealed by ChatGPT Sol before an unknown embargo has taken to the platform to apologize for the post. According to petecooper, they shared the CVEs because they wanted to alert others who follow the four-week PHP release cycle about the importance and urgency of the matter, but they weren’t aware of the news blackout that went with the two identified vulnerabilities.
“I posted here about the then-upcoming PHP RCEs related to CVE-2026-109618 & CVE-2026-109619. I appreciate this has had considerable knock-on effects with the schedule for co-ordinated disclosure, and created additional workload. I am truly sorry. I take full responsibility for my actions,” petecooper wrote on the platform. “It was not remotely my intention to cause any of the subsequent side effects. At the time of posting, I didn’t know about any embargo. My contact had told me there was no embargo, and her contact had told her the same thing.”
CVE-2026-109618 and CVE-2026-109619 are two critical vulnerabilities, both scored at 9.2. It seemed that the PHP Foundation planned for a controlled public release, allowing affected websites and applications to be patched before the vulnerabilities became widely known. Unfortunately, it seemed that some recipients of the warning failed to share the embargo that came alongside the CVEs, spreading the news earlier than expected.
It should be noted that petecooper apparently wasn’t the only one who leaked the news early. Multiple leaks had already been circulating on social media and other platforms, which forced the PHP Foundation to move its announcement up by one day. Despite that, the organization mentioned that Chainguard broke the embargo by more than six hours. Dan Lorenc, the co-founder and CEO of Chainguard, defended the move on LinkedIn, saying that he made the call after talking to several other researchers and immediately notified the group after releasing the fix publicly, and not just his customers.
The vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619 were bugs in the PHP runtime itself that were discovered using AI tools, not attacks by rogue AI. Still, the abilities of this technology could make it easier for both security researchers and bad actors to find vulnerabilities that could have been lurking in widely used code for years, if not decades. This makes it a race to find and deploy a fix before they could be exploited.