Party
Dan Lorenc, Chainguard
shipped patched images early; says exploits were in the wild and denies leaking
Claims this site attributes to this party
| Claim | Who says it | Status | Primary | Sources |
|---|---|---|---|---|
| Chainguard unilaterally broke the embargo on 21 October at 07:41 UTC by publishing built images containing the fix Dan Lorenc (via The Register): 'I made the call to get these out early when exploits hit in the wild'; several unnamed vendors had reported exploits; Chainguard's honeypots trapped IPs; a researcher warned the company on the Friday and its team then found the bugs independently with an AI harness. No evidence published. The PHP security team found no functional exploit by release time. | PHP Foundation; Chainguard's CEO accepts the time and denies leaking | disputed | 1/3 | PHP Foundation The Register Feross Aboukhadijeh on X on X |
| Chainguard's team found the same bugs independently with an AI harness and a frontier model after a researcher warned them on the Friday before Unverified by anyone else. | Dan Lorenc, via The Register | reported | 0/1 | The Register |
Its sources in the vault
- PHP blames supply chain security biz Chainguard for putting huge chunks of the web at risk The Register
- Feross on X: "Chainguard received PHP’s fix for two critical RCEs under embargo, like every other distributor. On October 21 at 07:41 UTC, more than six hours before the coordinated release, it published built images containing that fix. The PHP Foundation’s postmortem says Chainguard unilaterally… / X Feross Aboukhadijeh (@feross) on X