Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?

Risks / R02 The coordinated disclosure broke before the fix was ready / R02-3

R02-3: Patched builds published before the embargo lifted

Because built images containing the fix were published at 07:41 UTC on 21 October, before the release, anyone could diff them against the previous images, resulting in the fix itself becoming a map to the flaw.

Rating 16 high · Likelihood 4 Likely · Impact 4 Major · Kind Supply chain · Acceptance not recorded

Basis. Disputed: the Foundation says Chainguard broke the embargo; Chainguard denies leaking.

The path

Told inWhere php2shell standsWhere php2shell stan…php2shell in perspectivephp2shell in perspec…Acted on bySecurity lead and AppSecSecurity lead and Ap…HistorianHistorianStory site agentStory site agentCarried byChainguard (source)Chainguard (source)Distributors and packagers (owner)Distributors and pac…The PHP security team (regulator)The PHP security tea…RiskR02-3 Patched builds published before the embargo liftedR02-3 Patched builds…Arises fromOne embargo shared by many partiesOne embargo shared b…VulnerabilityCVE-2026-109618CVE-2026-109618CVE-2026-109619CVE-2026-109619Fixed byA soft memory limit that no longer jumpsA soft memory limit …A hard limit that ends the process cleanlyA hard limit that en…An orderly unwind at the next safe pointAn orderly unwind at…Allocations that may fail instead of abortAllocations that may…Request globals reset so nothing survives a failureRequest globals rese…Bounded, deduplicated request parsingBounded, deduplicate…CodeZend/zend_alloc.cZend/zend_alloc.cZend/zend_execute_API.cZend/zend_execute_AP…Zend/zend_hash.cZend/zend_hash.cZend/zend_string.cZend/zend_string.cZend/zend_types.hZend/zend_types.hext/session/session.cext/session/session.…main/SAPI.cmain/SAPI.cmain/main.cmain/main.cmain/rfc1867.cmain/rfc1867.c
The risk sits in the middle. To its left, the stories that tell it, the roles and team members that act on it, and every stakeholder that carries part of it. To its right, what it arises from, the vulnerability behind that, the part of the fix that addresses it and the code the fix changed. Every line is an edge in the graph; every node is a link; hover for the full name. Vulnerabilities, stories and team members include those of the risk this one is part of; roles include those of the risks above and beneath it.

Who carries it

One risk, assigned to every stakeholder that carries part of it, with the part each plays.

StakeholderPartWhyIts register
ChainguardsourcePublished the images, by the Foundation's account.1 risk
Distributors and packagersownerEvery builder in an embargo can do the same.3 risks
The PHP security teamregulatorSets the embargo's terms.7 risks

What it arises from

The evidence

ClaimStatusFact-checkSources
Chainguard unilaterally broke the embargo on 21 October at 07:41 UTC by publishing built images containing the fixdisputedA2 ReportedPHP Foundation The Register Feross Aboukhadijeh on X on X
Chainguard's team found the same bugs independently with an AI harness and a frontier model after a researcher warned them on the Friday beforereportedA2 ReportedThe Register

Treatments

TreatmentStatusWhere
Embargo terms that cover built artefacts, not only advisoriesmissingHow the coordinated disclosure broke

The standards that govern it

FrameworkControlWhat it asksFamily
ISO/IEC 29147 and 3011129147:coordinationCoordinating disclosure with other vendors and parties under embargoPractice and technique
Cyber Resilience ActArt.13Obligations of manufacturers, including due diligence on integrated third-party and open-source componentsLaw and regulation
NIST CSF 2.0GV.SC-05Supply chain requirements are established and integrated into contractsFrameworks and control catalogues
OWASP Top 10sA03:2025Software supply chain failuresPractice and technique

The stories that tell it

On this site: How the coordinated disclosure broke