<!-- mobian-agent-page publisher="dailydev" canonical="https://daily.dev/posts/php-blames-supply-chain-security-biz-chainguard-for-putting-huge-chunks-of-the-web-at-risk-2yoxepfaf" -->

---
title: PHP blames supply chain security biz Chainguard for...
description: PHP maintainers accused Chainguard of breaking an embargo on two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Chainguard published built...
canonical: https://daily.dev/posts/php-blames-supply-chain-security-biz-chainguard-for-putting-huge-chunks-of-the-web-at-risk-2yoxepfaf
twitter:card: summary_large_image
twitter:site: @dailydotdev
og:type: website
og:site_name: daily.dev
og:title: PHP blames supply chain security biz Chainguard for putting huge chunks of the web at risk | daily.dev
og:description: PHP maintainers accused Chainguard of breaking an embargo on two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Chainguard published built...
og:url: https://daily.dev/posts/php-blames-supply-chain-security-biz-chainguard-for-putting-huge-chunks-of-the-web-at-risk-2yoxepfaf
og:image: https://api.daily.dev/og/posts/2yoxEPFaF.png
og:image:alt: PHP blames supply chain security biz Chainguard for putting huge chunks of the web at risk
og:image:width: 1200
og:image:height: 630
og:locale: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# PHP blames supply chain security biz Chainguard for putting huge chunks of the web at risk

**[The Register](https://daily.dev/sources/theregister)** · 7 min read · 0 upvotes · 0 comments

## Summary

PHP maintainers accused Chainguard of breaking an embargo on two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Chainguard published built images containing the fix on October 21 at 07:41 UTC, more than six hours before the coordinated disclosure. Chainguard CEO Dan Lorenc says his company didn't leak, but shipped fixes early after seeing evidence of active exploitation. Wiz researchers say PHP powers 70 percent of websites, and every version since 5.4 is affected by at least one bug, both leading to remote code execution.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://www.theregister.com/security/2026/10/22/php-blames-supply-chain-security-biz-chainguard-for-putting-entire-web-at-risk/5304611>

## Questions this post answers

### What are CVE-2026-109618 and CVE-2026-109619 in PHP?

They are two critical memory corruption vulnerabilities in PHP that allow unauthenticated remote code execution. CVE-2026-109618 is triggered by out-of-memory corruption when a request hits PHP's memory_limit at the wrong moment, and on Apache with mod_php can be exploited before any application code runs. CVE-2026-109619 involves stale state after a fatal error, leading to use-after-free and RCE, demonstrated against a real-world Apache/mod_php application.

_Teams patching PHP servers can track critical CVE disclosures like these on daily.dev._

### Which PHP versions are affected by the PHP2shell vulnerabilities?

Every PHP version released in the last decade is affected by at least one of the two vulnerabilities, going back to version 5.4, according to Wiz researchers. Both bugs relate to memory management and error handling and can be exploited remotely, in some cases fairly easily, so immediate patching was strongly advised.

_Developers deciding how urgently to upgrade legacy PHP stacks can follow coverage like this on daily.dev._

### Why did Chainguard break the PHP vulnerability disclosure embargo?

Chainguard CEO Dan Lorenc said his company shipped fixes about six hours before the coordinated disclosure because people were already being hit by exploits in advance of the official release, and the company judged it was coordinated vulnerability disclosure unless there is evidence of active exploitation in the wild. Chainguard's own honeypots had trapped IPs from China and Russia targeting the vulnerabilities.

_Security teams weighing disclosure timing tradeoffs can follow how this standoff unfolds on daily.dev._

## Similar posts on daily.dev

- [PHP rushes out emergency patches for two critical bugs AI found first](https://daily.dev/posts/php-rushes-out-emergency-patches-for-two-critical-bugs-ai-found-first-smuf7gcab) · The Next Web · 0 upvotes · 0 comments

---

Tags: [#security](https://daily.dev/tags/security), [#php](https://daily.dev/tags/php)

[View this post on daily.dev](https://daily.dev/posts/php-blames-supply-chain-security-biz-chainguard-for-putting-huge-chunks-of-the-web-at-risk-2yoxepfaf)

```json
{"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]}
{"@context":"https://schema.org","@type":"TechArticle","headline":"PHP blames supply chain security biz Chainguard for putting huge chunks of the web at risk","url":"https://daily.dev/posts/php-blames-supply-chain-security-biz-chainguard-for-putting-huge-chunks-of-the-web-at-risk-2yoxepfaf","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/php-blames-supply-chain-security-biz-chainguard-for-putting-huge-chunks-of-the-web-at-risk-2yoxepfaf"},"datePublished":"2026-10-21T23:06:17.255Z","dateModified":"2026-10-22T00:48:47.647Z","description":"PHP maintainers accused Chainguard of breaking an embargo on two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Chainguard published built...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/6c18c40d1a737a548659d6699c116fef?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/6c18c40d1a737a548659d6699c116fef?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"The Register","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"The Register","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/66aa2113fdad463992ffcbf0e8963fda","url":"https://daily.dev/sources/theregister"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/php-blames-supply-chain-security-biz-chainguard-for-putting-huge-chunks-of-the-web-at-risk-2yoxepfaf","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,php","timeRequired":"PT7M"}
{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"The Register","item":"https://daily.dev/sources/theregister"},{"@type":"ListItem","position":3,"name":"PHP blames supply chain security biz Chainguard for putting huge chunks of the web at risk"}]}
{"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/php-blames-supply-chain-security-biz-chainguard-for-putting-huge-chunks-of-the-web-at-risk-2yoxepfaf#faq","mainEntity":[{"@type":"Question","name":"What are CVE-2026-109618 and CVE-2026-109619 in PHP?","acceptedAnswer":{"@type":"Answer","text":"They are two critical memory corruption vulnerabilities in PHP that allow unauthenticated remote code execution. CVE-2026-109618 is triggered by out-of-memory corruption when a request hits PHP's memory_limit at the wrong moment, and on Apache with mod_php can be exploited before any application code runs. CVE-2026-109619 involves stale state after a fatal error, leading to use-after-free and RCE, demonstrated against a real-world Apache/mod_php application. Teams patching PHP servers can track critical CVE disclosures like these on daily.dev."}},{"@type":"Question","name":"Which PHP versions are affected by the PHP2shell vulnerabilities?","acceptedAnswer":{"@type":"Answer","text":"Every PHP version released in the last decade is affected by at least one of the two vulnerabilities, going back to version 5.4, according to Wiz researchers. Both bugs relate to memory management and error handling and can be exploited remotely, in some cases fairly easily, so immediate patching was strongly advised. Developers deciding how urgently to upgrade legacy PHP stacks can follow coverage like this on daily.dev."}},{"@type":"Question","name":"Why did Chainguard break the PHP vulnerability disclosure embargo?","acceptedAnswer":{"@type":"Answer","text":"Chainguard CEO Dan Lorenc said his company shipped fixes about six hours before the coordinated disclosure because people were already being hit by exploits in advance of the official release, and the company judged it was coordinated vulnerability disclosure unless there is evidence of active exploitation in the wild. Chainguard's own honeypots had trapped IPs from China and Russia targeting the vulnerabilities. Security teams weighing disclosure timing tradeoffs can follow how this standoff unfolds on daily.dev."}}]}
```