PHP2Shell exposes the weakness in coordinated vulnerability disclosure

Publisher excerpt From CSO Online

Two critical vulnerabilities discovered in the widely-used PHP programming language have shaken up enterprises, and the ramifications will take some time to truly understand. But one of the lesser-known stories centers around disclosure. According to The PHP Foundation, several organizations had agreed to a coordinated release detailing the critical flaws and mitigation actions, but cybersecurity firm Chainguard “unlaterally” broke this embargo. This prompted the PHP project to release its patches early, but also allowed attackers to study the fix in binary form and craft proofs-of-concept (PoCs) for exploits before defenders had a chance to update their systems. But some, including AWS and Cloudflare, contend that active exploits began hours, even days before the disclosure. By some estimates, there have since been millions of attempts to abuse the 9.2-severity-rated bugs, collectively known as PHP2Shell. Many organizations, including government bodies, have reacted by taking their websites offline altogether. “Frankly, the disclosure story is more interesting than the bugs themselves,” said Frank Dickson of Dickson Research. “Embargoes matter. This one was nearly impossible to keep.” The messy disclosure CVE-2026-109618 and CVE-2026-109619 could allow attackers to launch remote code execution (RCE) attacks. The PHP Foundation acknowledged that one of its contractors had discovered the first signs of the out-of-memory (OOM) problem behind CVE-2026-109618 as far back…

Excerpt only, shown with attribution. This content belongs to the original publisher and has not been independently verified by CyberSecurity.pk.