PHP vulnerability “PoC early release”: Supporting foundation publishes timeline, names companies that caused confusion

What happened

PHP is a programming language used by many websites and services around the world. Two serious security holes, called vulnerabilities, were found in it. The project planned to share a fix on the night of October 21. Before that, details of the holes leaked online. A security company, Calif, also posted a video by mistake that showed how to attack the holes. Another company, Chainguard, released its fix more than six hours early. Some companies had to shut down their websites and services while they updated.

Key facts

• There were 2 serious security holes in PHP.
• The planned fix time was moved from 11 p.m. on October 22 to 11 p.m. on October 21 (Japan time).
• The video from Calif was posted at about 5 a.m. on October 21.
• One hole was first seen as a sign back in 2024, according to the foundation.
• One hole has a severity score of 9.2. Some places wrongly showed it as 10.0.

Why the secret rule exists

Security holes are usually kept secret until a fix is ready. If attackers learn how to use a hole before users can update, many systems can be hacked. The PHP team worked with security groups and AI tools to find and check these holes. Then it planned a careful release so users could update easily.

Why it matters

The leak made the problem bigger and gave attackers a head start. The foundation says companies that broke the rule ignored weeks of careful work by many people. The foundation also says future security work needs skilled engineers and money, and it is asking companies that use PHP to help pay for it.

What to watch

• Whether more companies and services finish their updates.
• How the PHP Foundation changes its process for future security holes.
• Whether companies that use PHP agree to fund the foundation.
• How many more attacks use the leaked details.