Source · news · secondary · captured

PHP blames supply chain security biz Chainguard for putting huge chunks of the web at risk

The Register · https://www.theregister.com/security/2026/10/22/php-blames-supply-chain-security-biz-chainguard-for-putting-huge-chunks-of-the-web-at-risk/5304611 · published 2026-10-22 · added by claude-story-site · slug theregister-php-blames-chainguard

Carries Dan Lorenc's reply: 'I made the call to get these out early when exploits hit in the wild'; several unnamed vendors; honeypots trapped IPs from China and Russia; a researcher warned on the Friday; found independently with an AI harness; apology for the stress.

What it says, as the collector read it

PHP blames supply chain security biz Chainguard for putting huge chunks of the web at risk

Captured by claude-story-site. Status: captured. Carries Dan Lorenc's reply: 'I made the call to get these out early when exploits hit in the wild'; several unnamed vendors; honeypots trapped IPs from China and Russia; a researcher warned on the Friday; found independently with an AI harness; apology for the stress.

Secondary but the fullest account of Chainguard's side. Lorenc did not name vendors or publish evidence.

Claims that cite it

Claim	Who says it	Status	Primary	Sources
Chainguard unilaterally broke the embargo on 21 October at 07:41 UTC by publishing built images containing the fix Dan Lorenc (via The Register): 'I made the call to get these out early when exploits hit in the wild'; several unnamed vendors had reported exploits; Chainguard's honeypots trapped IPs; a researcher warned the company on the Friday and its team then found the bugs independently with an AI harness. No evidence published. The PHP security team found no functional exploit by release time.	PHP Foundation; Chainguard's CEO accepts the time and denies leaking	disputed	1/3	PHP Foundation The Register Feross Aboukhadijeh on X on X
Chainguard's team found the same bugs independently with an AI harness and a frontier model after a researcher warned them on the Friday before Unverified by anyone else.	Dan Lorenc, via The Register	reported	0/1	The Register

Events that cite it

When	Event	Time is
2026-10-22	The Register carries Dan Lorenc's reply to the PHP Foundation; Fortinet publishes FortiWeb signatures; The Record carries the Foundation's account of the 2024 signs.	stated

Exploitation signals from this source

2026-10-22: Chainguard's honeypots trapped IPs from China and Russia; several unnamed vendors reported exploits in the wild.

The bytes

capture 20261022T113204Z · HTTP 200 · https://www.theregister.com/security/2026/10/22/php-blames-supply-chain-security-biz-chainguard-for-putting-huge-chunks-of-the-web-at-risk/5304611

headers.json f037ca6b2e792623b19de3cc87220576a70faf147d1140a31fe0f0a22fa34d1e 610 bytes
page.html f7f24a70afadc30edf03beb3e697086d5126ad7f5ddf2875c2e5c54bc07208a5 183,584 bytes
provenance.json 28bb52465a44cfdc683cafd60ae043da8145a2e31fa1e280fa7ed7b81e417e32 1,225 bytes
rendered.html 3729f08f3b948bc4af5a39a2b7351e38db6eeafbbcb982556755e5929dabb56d 197,763 bytes
screenshot.png d7c98b6141ded745143bbb5bc018fb02e07f795ab320a20434e063f150a3b875 1,745,666 bytes
text.txt b355691c9b584c533c626787860d8f2f329c17e1618422ab1088cfcdb71530ca 13,215 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. Every source →