PHP2Shell exposes weaknesses in coordinated vulnerability disclosure

The critical PHP2Shell PHP flaws (CVE-2026-109618 and CVE-2026-109619, severity 9.2) slipped out of embargo early: Chainguard published patched images about six hours before the agreed release time. The PHP project shipped fixes a day early, while Cloudflare and AWS reported exploitation attempts before public disclosure.

• Chainguard published patched images on Oct 21 at 07:41 UTC, ~6 hours before embargo
• PHP project moved patch release from Oct 22 to Oct 21, a day early
• Cloudflare saw thousands of exploit attempts 10 hours before the announcement
• AWS logged an exploit attempt on Oct 17, four days before disclosure