Chainguard's team found the same bugs independently with an AI harness and a frontier model after a researcher warned them on the Friday before

Fact-check

A2 Reported●●○○○○ · Attribution · verdict: holds

The Register reports, in its own words, that Lorenc said Chainguard learned 'something was coming in PHP' on Friday from one of the researchers and that night independently found the same bugs with its AI harness and a frontier model. One named party, second-hand through one outlet; nobody else checks it.

Open tickets: Finding-82.

Graded in Run-1, resting on captures up to 2026-10-22 11:32 UTC. The scale is on the fact-check page.

This fact over time

1. 2026-10-22The Register publishes PHP blames supply chain security biz Chainguard for putting huge chunks of the web at risk
2. 2026-10-22 11:32 UTCSaved into the evidence vault: The Register
3. 2026-10-22Enters this site as reported in v0.2.0 (reconstructed from git)

Published: when the source says it was published. Saved: the first capture into the evidence vault. The rest are this site: the release in which the fact first appeared and every release that changed its wording, sources or status.

What it rests on

Where this fact appears

In the briefings for:

And on every claim.

Every version of this fact

Chainguard's team found the same bugs independently with an AI harness and a frontier model after a researcher warned them on the Friday before
Who says it: Dan Lorenc, via The Register
Status: reported
Topic: discovery
Sources: theregister-php-blames-chainguard