Who Really Screwed Up the PHP2Shell Security Crisis?

Harness

Oct 31, 2026

The PHP2Shell vulnerability triggered a massive cybersecurity crisis. But the real story isn't just about the PHP security flaw. It's about who broke the rules, who was responsible, and whether one controversial decision made everything worse.

In October 2026, researchers uncovered critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that threatened websites and applications across the internet. As security teams scrambled to prepare patches, the coordinated disclosure process began falling apart.

Then Chainguard released patched PHP images more than six hours ahead of the agreed schedule, sparking a dispute with the PHP Foundation over whether the decision helped protect users or created additional risk.

So what really happened? Who made the call? And who deserves the blame?

In this episode of ShipTalk, Martin Reynolds and Adam Arellano break down:

What PHP2Shell is and how the critical PHP vulnerabilities were discovered
How AI-powered security research is changing vulnerability discovery
Why Chainguard's early patch release caused controversy
What happened during the PHP security embargo
Who was responsible for the disclosure breakdown
Why patching vulnerabilities doesn't necessarily mean your systems are secure
How shadow IT, vibe coding, and AI-generated applications create new cybersecurity risks

This isn't just a story about one PHP exploit. It's a warning about what happens when AI accelerates vulnerability discovery faster than the software industry can respond.