PHP blames supply chain security biz for putting chunks of the web at risk (www.theregister.com)

PHP developers have accused Chainguard, a software supply chain security company, of prematurely revealing critical vulnerabilities in the PHP scripting language. Just hours after PHP released emergency patches for two newly discovered bugs—CVE-2026-109618 and CVE-2026-109619—PHP maintainers detailed the situation in a blog post. These vulnerabilities allow unauthenticated attackers to execute code on servers running PHP and are particularly concerning since PHP underpins approximately 70% of all websites. The controversy arose when information about the bugs and their severity started circulating on social media, prompting PHP to expedite their announcement to mitigate potential exploitation. Chainguard's CEO, Dan Lorenc, defended the company, stating that they independently identified the vulnerabilities using AI tools on the same day they learned about them from researchers. He emphasized the need for rapid disclosure when evidence of exploitation emerged, claiming that their early release of the fixes, meant to aid security, inadvertently compromised coordinated disclosure efforts. The implications of these vulnerabilities are profound, given that past versions of PHP dating back over a decade are affected, and they could lead to serious security breaches, including remote code execution. Immediate patching is recommended for all impacted systems to prevent exploitation.