Party
Chainguard
published patched images before the embargo lifted, per the Foundation
Claims this site attributes to this party
| Claim | Who says it | Status | Primary | Sources |
|---|---|---|---|---|
| Chainguard unilaterally broke the embargo on 21 October at 07:41 UTC by publishing built images containing the fix Dan Lorenc (via The Register): 'I made the call to get these out early when exploits hit in the wild'; several unnamed vendors had reported exploits; Chainguard's honeypots trapped IPs; a researcher warned the company on the Friday and its team then found the bugs independently with an AI harness. No evidence published. The PHP security team found no functional exploit by release time. | PHP Foundation; Chainguard's CEO accepts the time and denies leaking | disputed | 1/3 | PHP Foundation The Register Feross Aboukhadijeh on X on X |
Its sources in the vault
- Today's PHP Security Release, and How We're Strengthening PHP Security The PHP Foundation
- PHP accuses Chainguard in PHP2shell Techzine Global