PHP Foundation Says Chainguard Broke Security Embargo Ahead of Emergency Patches

The PHP Foundation said Chainguard violated a coordinated security embargo by publishing patched PHP container images more than six hours before the planned release of emergency fixes for two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Chainguard CEO Dan Lorenc defended the decision by citing reports of active exploitation, public leaks, and the ease of independently finding the flaw, while the Foundation said it had found no functional public proof-of-concept exploits by release time and characterized Chainguard’s action as unilateral. The disclosure process had already been disrupted by leaked CVE identifiers, an accidentally published exploit video, and possible leakage of mitigation guidance, prompting PHP to move its patch release forward by a day. The Foundation also acknowledged that the underlying memory-management issue had been recognized in 2024 but remained unresolved because of difficult technical trade-offs, limited specialist capacity, and a consensus-based process that stalled decisions until credible RCE reports emerged in August 2026. In response, PHP is adopting majority-based security decisions, escalating severe issues earlier, and seeking more funding for experienced engine developers as it manages a growing volume of vulnerability reports.

No tracked trend matches for this post yet.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.