What leaked, and when the patch actually shipped
The PHP project shipped security updates across the entire PHP 8.x line on 21 October 2026, one day ahead of the scheduled release. The patches close two remote code execution vulnerabilities. simonwillison.net, citing the project's own post, reports exploits had been circulating since the previous night following a leak in the coordinated disclosure process. The original schedule put the release at 14:00 UTC on 22 October; it moved to 21 October.
The leak was partial but disruptive. According to the PHP Foundation's account, published via simonwillison.net, the two CVE IDs began circulating on online forums and social media on Tuesday, 20 October, at around 15:00 UTC. They arrived with a wrong release time and a wrong CVSS score of 10.0; the actual score is 9.2. No technical details leaked. Identifiers alone, in other words, were enough to break the timeline.
The project responded on two fronts: it brought its pre-announcement forward to 19:30 UTC the same day, then pulled the patch release forward a full day. The sequence is instructive. A leak that contained no exploit code still forced an emergency response because the identifiers pointed at unpatched, critical code. That suggests disclosure processes now need to treat metadata — CVE numbers, scores, release dates — as sensitive in their own right.
How AI researchers found the flaws, and who is blamed for the leak
techcrunch.com attributes the discovery to OpenAI and Google's Wiz, reporting the story under the headline "PHP Armageddon: OpenAI, Google's Wiz find ancient holes." techbuzz.ai describes the findings as what security researchers are calling the most significant vulnerabilities ever found in PHP, and frames the incident as a watershed moment for AI-assisted security research. Two independent outlets agree on the AI provenance; neither details the discovery method.
The U.S. National Security Agency issued a warning on Wednesday, 21 October, that two critical holes had been found in PHP, with patches already issued by the PHP Foundation, per techcrunch.com. The scale of exposure is large: techbuzz.ai puts PHP at roughly 77 percent of all websites and reports European administrators racing to take sites offline and patch systems before attackers could exploit the flaws.
Blame has a named target. theregister.com reports PHP blames supply chain security business Chainguard for putting huge chunks of the web at risk. Chainguard's chief executive told theregister.com: "Coordinated vulnerability disclosure, unless there's evidence of active exploits in the wild." The statement is a defense of the firm's conduct, and it collides with the documented facts: exploits were circulating before the patch shipped. The open question is who within the disclosure chain leaked the CVE IDs.
What PHP administrators need to do now
Upgrade every PHP 8.x deployment. simonwillison.net calls the update vital for anyone running anything on PHP, and the patches cover the entire 8.x line rather than a single branch. Exploits have existed in the wild since the night of 20 October, so the patch is the only mitigation the record describes. No workaround, configuration change, or partial fix appears in the available reporting.
Some European administrators did not wait for the patch. techbuzz.ai reports sites being taken offline preemptively across Europe as part of the emergency response. Whether that is proportionate depends on exposure the record does not specify: no evidence states which configurations or code paths are vulnerable. The defensible reading is that a 9.2-rated flaw with circulating exploits and no published technical details leaves administrators guessing, and guessing favors shutdown.
Three signals to track. First, whether the source of the leak is formally established beyond PHP's attribution to Chainguard, a claim the firm's chief executive has addressed publicly. Second, whether Chainguard's stated position — coordinated disclosure holds unless there is evidence of active exploitation — becomes a reference point for vendors handling AI-found vulnerabilities. Third, whether discovery by AI systems pushes disclosure timelines toward assuming leaks, given that identifiers alone moved this release by a day.
Sources
- simonwillison.net — Two Critical PHP Holes, Found by AI, Get an Emergency Patch
- theregister.com — PHP blames supply chain security biz Chainguard for putting huge chunks of the web at risk (2026-10-21)
- techcrunch.com — PHP armageddon: OpenAI, Google's Wiz find ancient holes, panicking the internet (2026-10-21)
- techbuzz.ai — AI Uncovers Critical PHP Flaws, Europe Sites Go Dark (2026-10-21)
- New Horizon daily digest, 2026-10-22 (topic provenance)