Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?
Fact · leak · disputed
Chainguard unilaterally broke the embargo on 21 October at 07:41 UTC by publishing built images containing the fix
Dan Lorenc (via The Register): 'I made the call to get these out early when exploits hit in the wild'; several unnamed vendors had reported exploits; Chainguard's honeypots trapped IPs; a researcher warned the company on the Friday and its team then found the bugs independently with an AI harness. No evidence published. The PHP security team found no functional exploit by release time.
Fact-check
A2 Reported●●○○○○ opinion disputed · Opinion · verdict: holds in part
The act and time (built images with the fix at 07:41 UTC on 21 October) are the Foundation's and Lorenc 'doesn't dispute the timeline' (The Register). 'Unilaterally broke the embargo' is the Foundation's reading; Lorenc says exploits were in the wild and he notified the coordinated disclosure channel first, which contests 'unilaterally'. Feross and The Hacker News restate the Foundation (one origin).
| Capture checked | Result | What it says | sha256 of the text read |
|---|---|---|---|
| php-foundation-blog-security-release | carries | On October 21st at 07:41 UTC, more than six hours before the coordinated release, Chainguard unilaterally broke the embargo and published built images | a1be057adc1c5bfa |
| theregister-php-blames-chainguard | partial | late Tuesday night Lorenc told us he decided to ship the fixes, and notified the PHP coordinated disclosure channel about his plans. | b355691c9b584c53 |
| x-feross-chainguard | partial | Dan Lorenc says several vendors in the disclosure had reported exploits in the wild, and that he notified the group right after making the call. | de7648491d664137 |
| therecord-php-foundation-statement | partial | Dan Lorenc told Recorded Future News that he began to see exploitation attempts last night and made the judgement call to release the information. | 28c72344e03a5a79 |
Open tickets: Finding-10, Finding-62.
Graded in Run-1, resting on captures up to 2026-10-22 11:32 UTC. The scale is on the fact-check page.
This fact over time
- 2026-10-21PHP Foundation publishes Today's PHP Security Release, and How We're Strengthening PHP Security
- 2026-10-22The Register publishes PHP blames supply chain security biz Chainguard for putting huge chunks of the web at risk
- 2026-10-22Feross Aboukhadijeh on X on X publishes Feross on X: "Chainguard received PHP’s fix for two critical RCEs under embargo, like every other distributor.
- 2026-10-22 08:09 UTCSaved into the evidence vault: PHP Foundation
- 2026-10-22 11:21 UTCSaved into the evidence vault: Feross Aboukhadijeh on X on X
- 2026-10-22 11:32 UTCSaved into the evidence vault: The Register
- 2026-10-22Enters this site as disputed in v0.1.0 (reconstructed from git)
- 2026-10-22Reworded or re-sourced in v0.2.0 (reconstructed from git)
Published: when the source says it was published. Saved: the first capture into the evidence vault. The rest are this site: the release in which the fact first appeared and every release that changed its wording, sources or status.
What it rests on
Where this fact appears
In the briefings for:
And on every claim.
Every version of this fact
v1 · site v0.1.0 · 22 October 2026 · disputed
Chainguard unilaterally broke the embargo on 21 October at 07:41 UTC by publishing built images containing the fix Who says it: PHP Foundation Status: disputed Topic: leak Sources: php-foundation-blog-security-release, techzine-php-chainguard