Amid PHP Web-Hacking Alert, Some Distributors Face Patch-Leak Controversy After Breaking Coordination With a Surprise Release 6 Hours Early

[Financial News] At least 75% of websites worldwide use the programming language PHP. Ahead of the release of a patch for a security flaw in PHP, some companies have stirred controversy by releasing code earlier than promised.
The PHP Foundation said on the 21st (local time) that ChainGuard, a patch distributor, had made a surprise release of an image with the patch applied roughly six hours or more before the scheduled official release.
In an official statement, the foundation strongly criticized ChainGuard, saying, “ChainGuard unilaterally broke the embargo” and calling it “an act that disregarded the efforts made over several weeks by numerous parties to coordinate the disclosure.”
If a patch is released ahead of schedule, attackers such as hackers can reverse-engineer its code and develop tools to exploit the vulnerability.
With the official update not yet available, this gave hackers a six-hour window to analyze the code first, leaving users exposed and unable to defend themselves.
The foundation fumed: “All attackers were able to study the patch in advance, while users were still left waiting for its official release.”
The foundation did not say whether there had been any actual cases of harm resulting from the incident.
The incident was part of a series of information leaks that began before the official patch release.
PHP developers had originally planned to release the patch on the 22nd, but moved the release up by a day after vulnerability IDs and other information began circulating online on the 20th.
The foundation said hackers’ development of attack tools was accelerated when another security company, Calip, accidentally uploaded and then deleted a video demonstrating an attack exploiting the vulnerability.
With ChainGuard’s surprise patch release following these events, observers say the “time-gap defense system” has collapsed.
This failure of coordination is especially damaging given that advances in artificial intelligence (AI) tools have made it incomparably faster than before to reverse-engineer patch code and create attack tools.
Calip CEO Tai Duong, who first discovered the issue, warned, “Someone could take the patch, run it through AI, and post a script that exploits it. That would cause utter chaos.”
Without commenting on the patch leak, ChainGuard said on the social media platform X (formerly Twitter), “Coordinating the disclosure of vulnerabilities is difficult,” adding, “We deeply appreciate everyone’s help in addressing this issue over the past few days.”
Meanwhile, it emerged that PHP developers had detected signs of some flaws during an external security audit in 2024, but work on the patches had stalled amid difficulties reaching agreement within the development team and concerns about compatibility with existing programs.
The PHP Foundation admitted, “We will not hide the facts. This delay was a systemic failure stemming both from the security team’s decision-making process and from a lack of resources.”

[email protected] Lee Seok-woo, International Affairs Correspondent Reporter