Two critical PHP flaws took down hundreds of websites after a security disclosure went wrong

Two critical PHP vulnerabilities caused hundreds of websites, including those of hospitals and prefectures, to go offline this week, following a security disclosure process that went wrong. Leaks triggered a race against time, leading to a wave of cyberattacks. The vulnerabilities, discovered in 2024 but initially deemed theoretical, were proven exploitable in summer 2026 by researchers at Wiz using AI. The PHP Foundation admitted the delay was a "structural failure" due to resource shortages. The coordinated disclosure was planned for October 22, but Amazon detected exploitation attempts on October 18, and a Hacker News user leaked the vulnerability identifiers two days later. The fix was released a day early, but security firm Chainguard broke the embargo six hours before the official publication, allowing attackers to study the patch. Cloudflare recorded tens of thousands of attack attempts within 45 minutes, escalating to millions by the next day.