PHP developers have accused supply chain security company Chainguard of prematurely releasing patches for critical PHP vulnerabilities known as PHP2shell, disrupting a coordinated vulnerability disclosure and potentially putting many websites at risk. The vulnerabilities, found using AI tools and tracked as CVE-2026-109618 and CVE-2026-109619, allow unauthenticated remote code execution on servers running PHP versions dating back over a decade. Chainguard’s CEO defended the early patch release, citing evidence of active exploitation, but PHP maintainers criticized the move for undermining coordination efforts amid a complex and high-impact security incident.
PHP Blames Supply Chain Security Biz Chainguard for Putting Huge Chunks of the Web at Risk
