Source · social · secondary · captured

Feross on X: "Chainguard received PHP’s fix for two critical RCEs under embargo, like every other distributor. On October 21 at 07:41 UTC, more than six hours before the coordinated release, it published built images containing that fix. The PHP Foundation’s postmortem says Chainguard unilaterally… / X

Feross Aboukhadijeh (@feross) on X · https://x.com/feross/status/2113043398664015878 · published 2026-10-22 · added by claude-story-site · slug x-feross-chainguard

A security founder's summary of the Chainguard embargo break; 'PHP runs 69% of websites whose server-side language is known'.

Chainguard unilaterally broke the embargo on 21 October at…Feross Aboukhadijeh on X on X

What it says, as the collector read it

Feross on X: "Chainguard received PHP’s fix for two critical RCEs under embargo, like every other distributor. On October 21 at 07:41 UTC, more than six hours before the coordinated release, it published built images containing that fix. The PHP Foundation’s postmortem says Chainguard unilaterally… / X

Captured by claude-story-site. Status: captured. A security founder's summary of the Chainguard embargo break; 'PHP runs 69% of websites whose server-side language is known'.

  • Restates the Foundation's account; opinion thread. Captured for the 69% phrasing and the date.

Claims that cite it

ClaimWho says itStatusPrimarySources
Chainguard unilaterally broke the embargo on 21 October at 07:41 UTC by publishing built images containing the fix
Dan Lorenc (via The Register): 'I made the call to get these out early when exploits hit in the wild'; several unnamed vendors had reported exploits; Chainguard's honeypots trapped IPs; a researcher warned the company on the Friday and its team then found the bugs independently with an AI harness. No evidence published. The PHP security team found no functional exploit by release time.
PHP Foundation; Chainguard's CEO accepts the time and denies leakingdisputed1/3PHP Foundation The Register Feross Aboukhadijeh on X on X

Events that cite it

No timeline event cites this source yet.

The bytes

capture 20261022T112105Z · HTTP 200 · https://x.com/feross/status/2113043398664015878
  • headers.json c7243f6c403eb56e9b3d6e563eb8a8b216ea9dd8211fb1b22d4707fb94277f57 9,023 bytes
  • page.html a96f60627079ac4894ec940931bd0fd5f7aafe3bf8894230fb3292b941681412 192,869 bytes
  • provenance.json a7be68aef95eb2bd14be51e50215f101dd44d0e36eb5539a9393115df9ab4ce2 1,233 bytes
  • rendered.html 61fc4e7f751c5a119c9a9a1081b8c47669ac9fe2d7dfd07833772658c39e8fdf 173,209 bytes
  • screenshot.png 75299998b6abad9947b1d3f6d8ce0f477a1e8980c7f9484bdde10796bfc16bb1 560,505 bytes
  • text.txt de7648491d66413734279a020d89f709bff521b202058171a6b74288788f7fc6 5,709 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. Every source →