# Source: Feross on X: "Chainguard received PHP’s fix for two critical RCEs under embargo, like every other distributor. On October 21 at 07:41 UTC, more than six hours before the coordinated release, it published built images containing that fix. The PHP Foundation’s postmortem says Chainguard unilaterally… / X

Feross Aboukhadijeh (@feross) on X: what it says, the claims and events that cite it, and the hashes of every captured file.

Source · social · secondary · captured

# Feross on X: "Chainguard received PHP’s fix for two critical RCEs under embargo, like every other distributor. On October 21 at 07:41 UTC, more than six hours before the coordinated release, it published built images containing that fix. The PHP Foundation’s postmortem says Chainguard unilaterally… / X

**Feross Aboukhadijeh (@feross) on X** · [https://x.com/feross/status/2113043398664015878](https://x.com/feross/status/2113043398664015878) · published 2026-10-22 · added by `claude-story-site` · slug `x-feross-chainguard`

A security founder's summary of the Chainguard embargo break; 'PHP runs 69% of websites whose server-side language is known'.

## What it says, as the collector read it

#### Feross on X: "Chainguard received PHP’s fix for two critical RCEs under embargo, like every other distributor. On October 21 at 07:41 UTC, more than six hours before the coordinated release, it published built images containing that fix. The PHP Foundation’s postmortem says Chainguard unilaterally… / X

Captured by claude-story-site. Status: captured. A security founder's summary of the Chainguard embargo break; 'PHP runs 69% of websites whose server-side language is known'.

- Restates the Foundation's account; opinion thread. Captured for the 69% phrasing and the date.

## Claims that cite it

| Claim | Who says it | Status | Primary | Sources |
|---|---|---|---|---|
| Chainguard unilaterally broke the embargo on 21 October at 07:41 UTC by publishing built images containing the fixDan Lorenc (via The Register): 'I made the call to get these out early when exploits hit in the wild'; several unnamed vendors had reported exploits; Chainguard's honeypots trapped IPs; a researcher warned the company on the Friday and its team then found the bugs independently with an AI harness. No evidence published. The PHP security team found no functional exploit by release time. | PHP Foundation; Chainguard's CEO accepts the time and denies leaking | disputed | 1/3 | [PHP Foundation](../../sources/php-foundation-blog-security-release/index.html) [The Register](../../sources/theregister-php-blames-chainguard/index.html) [Feross Aboukhadijeh on X on X](../../sources/x-feross-chainguard/index.html) |

## Events that cite it

No timeline event cites this source yet.

## The bytes
capture 20261022T112105Z · HTTP 200 · https://x.com/feross/status/2113043398664015878- `headers.json` c7243f6c403eb56e9b3d6e563eb8a8b216ea9dd8211fb1b22d4707fb94277f57 9,023 bytes
- `page.html` a96f60627079ac4894ec940931bd0fd5f7aafe3bf8894230fb3292b941681412 192,869 bytes
- `provenance.json` a7be68aef95eb2bd14be51e50215f101dd44d0e36eb5539a9393115df9ab4ce2 1,233 bytes
- `rendered.html` 61fc4e7f751c5a119c9a9a1081b8c47669ac9fe2d7dfd07833772658c39e8fdf 173,209 bytes
- `screenshot.png` 75299998b6abad9947b1d3f6d8ce0f477a1e8980c7f9484bdde10796bfc16bb1 560,505 bytes
- `text.txt` de7648491d66413734279a020d89f709bff521b202058171a6b74288788f7fc6 5,709 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. [Every source →](../index.html)


---
site v0.2.5 · data as of 2026-10-22T11:34Z · vault commit 200d08971937 · https://php.oct.2026.newsroom.sgit.ai/sources/x-feross-chainguard/index.html