# Fact: Chainguard unilaterally broke the embargo on 21 October at 07:41 UTC by publishi

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

Chainguard unilaterally broke the embargo on 21 October at 07:41 UTC by publishing built images containing the fix Who says it, its status (disputed), its sources, and its timeline from publication to this site.

Fact · leak · disputed

# Chainguard unilaterally broke the embargo on 21 October at 07:41 UTC by publishing built images containing the fix

**Who says it:** PHP Foundation; Chainguard's CEO accepts the time and denies leaking · **Sources:** [PHP Foundation](../../sources/php-foundation-blog-security-release/index.html) [The Register](../../sources/theregister-php-blames-chainguard/index.html) [Feross Aboukhadijeh on X on X](../../sources/x-feross-chainguard/index.html)

Dan Lorenc (via The Register): 'I made the call to get these out early when exploits hit in the wild'; several unnamed vendors had reported exploits; Chainguard's honeypots trapped IPs; a researcher warned the company on the Friday and its team then found the bugs independently with an AI harness. No evidence published. The PHP security team found no functional exploit by release time.

## Fact-check

**A2** Reported●●○○○○ opinion disputed · Opinion · verdict: **holds in part**

The act and time (built images with the fix at 07:41 UTC on 21 October) are the Foundation's and Lorenc 'doesn't dispute the timeline' (The Register). 'Unilaterally broke the embargo' is the Foundation's reading; Lorenc says exploits were in the wild and he notified the coordinated disclosure channel first, which contests 'unilaterally'. Feross and The Hacker News restate the Foundation (one origin).

| Capture checked | Result | What it says | sha256 of the text read |
|---|---|---|---|
| [php-foundation-blog-security-release](../../sources/php-foundation-blog-security-release/index.html) | carries | *On October 21st at 07:41 UTC, more than six hours before the coordinated release, Chainguard unilaterally broke the embargo and published built images* | a1be057adc1c5bfa |
| [theregister-php-blames-chainguard](../../sources/theregister-php-blames-chainguard/index.html) | partial | *late Tuesday night Lorenc told us he decided to ship the fixes, and notified the PHP coordinated disclosure channel about his plans.* | b355691c9b584c53 |
| [x-feross-chainguard](../../sources/x-feross-chainguard/index.html) | partial | *Dan Lorenc says several vendors in the disclosure had reported exploits in the wild, and that he notified the group right after making the call.* | de7648491d664137 |
| [therecord-php-foundation-statement](../../sources/therecord-php-foundation-statement/index.html) | partial | *Dan Lorenc told Recorded Future News that he began to see exploitation attempts last night and made the judgement call to release the information.* | 28c72344e03a5a79 |

Open tickets: [Finding-10](../../factcheck/index.html#Finding-10), [Finding-62](../../factcheck/index.html#Finding-62).

Graded in Run-1, resting on captures up to 2026-10-22 11:32 UTC. The scale is on [the fact-check page](../../factcheck/index.html#ladder).

## This fact over time
- 2026-10-21PHP Foundation publishes [Today's PHP Security Release, and How We're Strengthening PHP Security](../../sources/php-foundation-blog-security-release/index.html)
- 2026-10-22The Register publishes [PHP blames supply chain security biz Chainguard for putting huge chunks of the web at risk](../../sources/theregister-php-blames-chainguard/index.html)
- 2026-10-22Feross Aboukhadijeh on X on X publishes [Feross on X: "Chainguard received PHP’s fix for two critical RCEs under embargo, like every other distributor.](../../sources/x-feross-chainguard/index.html)
- 2026-10-22 08:09 UTCSaved into the evidence vault: PHP Foundation
- 2026-10-22 11:21 UTCSaved into the evidence vault: Feross Aboukhadijeh on X on X
- 2026-10-22 11:32 UTCSaved into the evidence vault: The Register
- 2026-10-22Enters this site as disputed in v0.1.0 (reconstructed from git)
- 2026-10-22Reworded or re-sourced in v0.2.0 (reconstructed from git)

Published: when the source says it was published. Saved: the first capture into the evidence vault. The rest are this site: the release in which the fact first appeared and every release that changed its wording, sources or status.

## What it rests on

## Where this fact appears

In the briefings for:
RRowanJournalistAAshSecurity researcherBBlakeAnalyst or policy advisor
And on [every claim](../../claims/index.html#chainguard).

## Every version of this fact
v1 · site v0.1.0 · 22 October 2026 · disputed
```
Chainguard unilaterally broke the embargo on 21 October at 07:41 UTC by publishing built images containing the fix
Who says it: PHP Foundation
Status: disputed
Topic: leak
Sources: php-foundation-blog-security-release, techzine-php-chainguard
```
v2 · site v0.2.0 · 22 October 2026 · disputedChainguard unilaterally broke the embargo on 21 October at 07:41 UTC by publishing built images containing the fixWho says it: PHP FoundationFoundation; Chainguard's CEO accepts the time and denies leakingStatus: disputedTopic: leakSources: php-foundation-blog-security-release, techzine-php-chainguardtheregister-php-blames-chainguard, x-feross-chainguard


---
site v0.8.0 · data as of 2026-10-22T11:34Z · vault commit 200d08971937 · https://php.oct.2026.newsroom.sgit.ai/facts/chainguard/index.html