PHP Foundation Details How PHP Vulnerability Was Published Early, Names Companies Blamed for Confusion

What happened

PHP is a programming language used by many websites and services around the world. Two serious security flaws, called vulnerabilities, were found in it. The project planned to keep the details secret until a security update was released. But before that, details spread on social media. A video that showed how to attack the flaws was also posted by mistake, and some companies released fixes early. The PHP Foundation has now published a timeline and criticized those companies.

Key facts

• The update was released on the night of October 21, Japan time. It was planned for October 22, but was moved earlier because of the leak.
• The real severity score of the flaws is 9.2. Some posts wrongly showed it as 10.0.
• Chainguard released its fix more than 6 hours early.
• The Japanese Prime Minister, Sanae Takaichi, asked people on social media to take action.

Why the secret was kept

When a security flaw is found, teams usually keep it secret until a fix is ready. This stops attackers from using it before users can update. Here, the fix was hard to package, and an early release could make it hard for many users to update. So the team chose to announce only that the flaws existed first.

Why it matters

This case shows how a leak can hurt many people at once. Attackers could study the fix before most users were protected. The PHP Foundation also says AI tools are finding more flaws, so future fixes may need to be faster and more careful. It asks companies that use PHP to pay for experienced engineers.

What to watch

• Whether more companies take their websites or services offline to apply the update.
• Whether the PHP Foundation gets more funding from companies that use PHP.
• How the PHP project changes its process for reporting complex flaws.
• How many more flaws AI tools find in the coming months.