[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"public-config":3,"i-flag:ph-4x3":14,"i-flag:us-4x3":19,"i-flag:de-4x3":21,"i-flag:hk-4x3":23,"i-tabler:lifebuoy":25,"i-tabler:timeline":28,"i-tabler:apps":30,"i-tabler:package":32,"i-tabler:circle-half-2":34,"i-tabler:sun":36,"i-tabler:moon":38,"i-tabler:menu-2":40,"i-tabler:user":42,"i-tabler:notebook":44,"i-simple-icons:forgejo":46,"i-tabler:shield-lock":48,"i-tabler:tools":50,"i-tabler:calendar":52,"i-tabler:x":54,"$f3456e52vhanhe":56,"i-tabler:arrow-left":114,"i-tabler:tag":116},{"matomo":4,"booking":7,"site":9,"blog":11,"newsletter":12},{"enabled":5,"siteId":6},true,"7",{"enabled":5,"url":8},"https:\u002F\u002Fcal.com\u002Fjdbungart",{"url":10},"https:\u002F\u002Fjdneer.com",{"enabled":5},{"enabled":13},false,{"left":15,"top":15,"width":16,"height":17,"rotate":15,"vFlip":13,"hFlip":13,"body":18},0,640,480,"\u003Cpath fill=\"#0038a8\" d=\"M0 0h640v240H0z\"\u002F>\u003Cpath fill=\"#ce1126\" d=\"M0 240h640v240H0z\"\u002F>\u003Cpath fill=\"#fff\" d=\"M415.7 240L0 480V0\"\u002F>\u003Cpath fill=\"#fcd116\" d=\"M26.7 42.4L41 55l16.6-9.2l-7.4 17.5l14 13l-19-1.6l-8.1 17.2l-4.3-18.5L14 71l16.3-10zm323.8 172.3l.4 19l18 6.3l-18 6.2l-.4 19l-11.5-15.1l-18.2 5.5l10.8-15.6l-10.8-15.6l18.2 5.5zM37.2 388.1l8 17.2l19-1.6l-13.9 13l7.4 17.5l-16.6-9.1l-14.4 12.4l3.6-18.7L14 409l18.9-2.4zm114.2-249l-6.2 6.2l3.1 47l-3 .3l-5.7-42.9l-5.1 5l7.6 38.4a48 48 0 0 0-17.2 7.1l-21.7-32.4H96l26.4 34.3l-2.4 2l-31.1-35.5h-8.8v8.8l35.4 31l-2 2.5l-34.3-26.3v7.1l32.5 21.7q-5.2 7.8-7.1 17.2L66.3 223l-5.1 5l42.9 5.7q-.3 1.6-.3 3.1l-47-3l-6.2 6.2l6.2 6.2l47-3.1l.3 3.1l-42.9 5.7l5 5l38.4-7.6a48 48 0 0 0 7.1 17.2l-32.5 21.7v7.2l34.3-26.3l2 2.4l-35.4 31v8.8H89l31-35.4l2.5 2L96 312.2h7.2l21.7-32.5q7.8 5.2 17.2 7.1l-7.6 38.4l5 5l5.7-42.9q1.5.3 3.1.3l-3 47l6.1 6.2l6.3-6.2l-3.1-47l3-.3l5.7 43l5.1-5.1l-7.6-38.4a48 48 0 0 0 17.2-7.1l21.7 32.5h7.2l-26.4-34.3l2.4-2l31.1 35.4h8.8v-8.8l-35.4-31l2-2.4l34.3 26.3v-7.2l-32.5-21.7q5.2-7.8 7.1-17.2l38.3 7.6l5.1-5l-42.9-5.7q.3-1.5.3-3.1l47 3l6.2-6.1l-6.2-6.2l-47 3l-.3-3l42.9-5.7l-5-5l-38.4 7.5a48 48 0 0 0-7.1-17.2l32.5-21.7v-7.1l-34.3 26.3l-2-2.4l35.4-31v-8.9H214l-31 35.5l-2.5-2l26.4-34.3h-7.2L178 200.2q-7.8-5.2-17.2-7.1l7.6-38.3l-5-5l-5.7 42.8l-3.1-.3l3-47z\"\u002F>",{"left":15,"top":15,"width":16,"height":17,"rotate":15,"vFlip":13,"hFlip":13,"body":20},"\u003Cpath fill=\"#bd3d44\" d=\"M0 0h640v480H0\"\u002F>\u003Cpath stroke=\"#fff\" stroke-width=\"37\" d=\"M0 55.3h640M0 129h640M0 203h640M0 277h640M0 351h640M0 425h640\"\u002F>\u003Cpath fill=\"#192f5d\" d=\"M0 0h364.8v258.5H0\"\u002F>\u003Cmarker id=\"SVGEq3dreKJ\" markerHeight=\"30\" markerWidth=\"30\">\u003Cpath fill=\"#fff\" d=\"m14 0l9 27L0 10h28L5 27z\"\u002F>\u003C\u002Fmarker>\u003Cpath fill=\"none\" marker-mid=\"url(#SVGEq3dreKJ)\" d=\"m0 0l16 11h61h61h61h61h60L47 37h61h61h60h61L16 63h61h61h61h61h60L47 89h61h61h60h61L16 115h61h61h61h61h60L47 141h61h61h60h61L16 166h61h61h61h61h60L47 192h61h61h60h61L16 218h61h61h61h61h60z\"\u002F>",{"left":15,"top":15,"width":16,"height":17,"rotate":15,"vFlip":13,"hFlip":13,"body":22},"\u003Cpath fill=\"#fc0\" d=\"M0 320h640v160H0z\"\u002F>\u003Cpath fill=\"#000001\" d=\"M0 0h640v160H0z\"\u002F>\u003Cpath fill=\"red\" d=\"M0 160h640v160H0z\"\u002F>",{"left":15,"top":15,"width":16,"height":17,"rotate":15,"vFlip":13,"hFlip":13,"body":24},"\u003Cpath fill=\"#ec1b2e\" d=\"M0 0h640v480H0\"\u002F>\u003Cpath id=\"SVG5tfvBPpj\" fill=\"#fff\" d=\"M346.3 103.1C267 98 230.6 201.9 305.6 240.3c-26-22.4-20.6-55.3-10.1-72.4l1.9 1.1c-13.8 23.5-11.2 52.7 11.1 71c-12.7-12.3-9.5-39 12.1-48.9s23.6-39.3 16.4-49.1q-14.7-25.6 9.3-38.9M307.9 164l-4.7 7.4l-1.8-8.6l-8.6-2.3l7.8-4.3l-.6-8.9l6.5 6.1l8.3-3.3l-3.7 8.1l5.6 6.8z\"\u002F>\u003Cuse href=\"#SVG5tfvBPpj\" transform=\"rotate(72 312.5 243.5)\"\u002F>\u003Cuse href=\"#SVG5tfvBPpj\" transform=\"rotate(144 312.5 243.5)\"\u002F>\u003Cuse href=\"#SVG5tfvBPpj\" transform=\"rotate(216 312.5 243.5)\"\u002F>\u003Cuse href=\"#SVG5tfvBPpj\" transform=\"rotate(288 312.5 243.5)\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":27},24,"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"M8 12a4 4 0 1 0 8 0a4 4 0 1 0-8 0\"\u002F>\u003Cpath d=\"M3 12a9 9 0 1 0 18 0a9 9 0 1 0-18 0m12 3l3.35 3.35M9 15l-3.35 3.35m0-12.7L9 9m9.35-3.35L15 9\"\u002F>\u003C\u002Fg>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":29},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"m4 16l6-7l5 5l5-6\"\u002F>\u003Cpath d=\"M14 14a1 1 0 1 0 2 0a1 1 0 1 0-2 0M9 9a1 1 0 1 0 2 0a1 1 0 1 0-2 0m-6 7a1 1 0 1 0 2 0a1 1 0 1 0-2 0m16-8a1 1 0 1 0 2 0a1 1 0 1 0-2 0\"\u002F>\u003C\u002Fg>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":31},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M4 5a1 1 0 0 1 1-1h4a1 1 0 0 1 1 1v4a1 1 0 0 1-1 1H5a1 1 0 0 1-1-1zm0 10a1 1 0 0 1 1-1h4a1 1 0 0 1 1 1v4a1 1 0 0 1-1 1H5a1 1 0 0 1-1-1zm10 0a1 1 0 0 1 1-1h4a1 1 0 0 1 1 1v4a1 1 0 0 1-1 1h-4a1 1 0 0 1-1-1zm0-8h6m-3-3v6\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":33},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"m12 3l8 4.5v9L12 21l-8-4.5v-9zm0 9l8-4.5M12 12v9m0-9L4 7.5m12-2.25l-8 4.5\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":35},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M3 12a9 9 0 1 0 18 0a9 9 0 1 0-18 0m9-9v18m0-7l7-7m-7 12l8.5-8.5M12 9l4.5-4.5\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":37},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M8 12a4 4 0 1 0 8 0a4 4 0 1 0-8 0m-5 0h1m8-9v1m8 8h1m-9 8v1M5.6 5.6l.7.7m12.1-.7l-.7.7m0 11.4l.7.7m-12.1-.7l-.7.7\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":39},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M12 3h.393a7.5 7.5 0 0 0 7.92 12.446A9 9 0 1 1 12 2.992z\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":41},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M4 6h16M4 12h16M4 18h16\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":43},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M8 7a4 4 0 1 0 8 0a4 4 0 0 0-8 0M6 21v-2a4 4 0 0 1 4-4h4a4 4 0 0 1 4 4v2\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":45},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M6 4h11a2 2 0 0 1 2 2v12a2 2 0 0 1-2 2H6a1 1 0 0 1-1-1V5a1 1 0 0 1 1-1m3 0v18m4-14h2m-2 4h2\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":47},"\u003Cpath fill=\"currentColor\" d=\"M16.777 0a2.9 2.9 0 1 1-2.529 4.322H12.91a4.266 4.266 0 0 0-4.265 4.195v2.118a7.08 7.08 0 0 1 4.147-1.42l.118-.002h1.338a2.9 2.9 0 0 1 5.43 1.422a2.9 2.9 0 0 1-5.43 1.422H12.91a4.266 4.266 0 0 0-4.265 4.195v2.319A2.9 2.9 0 0 1 7.222 24A2.9 2.9 0 0 1 5.8 18.57V8.589a7.11 7.11 0 0 1 6.991-7.108l.118-.001h1.338A2.9 2.9 0 0 1 16.778 0M7.223 19.905a1.194 1.194 0 1 0 0 2.389a1.194 1.194 0 0 0 0-2.389m9.554-10.464a1.194 1.194 0 1 0 0 2.389a1.194 1.194 0 0 0 0-2.39m0-7.735a1.194 1.194 0 1 0 0 2.389a1.194 1.194 0 0 0 0-2.389\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":49},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"M12 3a12 12 0 0 0 8.5 3A12 12 0 0 1 12 21A12 12 0 0 1 3.5 6A12 12 0 0 0 12 3\"\u002F>\u003Cpath d=\"M11 11a1 1 0 1 0 2 0a1 1 0 1 0-2 0m1 1v2.5\"\u002F>\u003C\u002Fg>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":51},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"M3 21h4L20 8a1.5 1.5 0 0 0-4-4L3 17zM14.5 5.5l4 4\"\u002F>\u003Cpath d=\"M12 8L7 3L3 7l5 5M7 8L5.5 9.5M16 12l5 5l-4 4l-5-5m4 1l-1.5 1.5\"\u002F>\u003C\u002Fg>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":53},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M4 7a2 2 0 0 1 2-2h12a2 2 0 0 1 2 2v12a2 2 0 0 1-2 2H6a2 2 0 0 1-2-2zm12-4v4M8 3v4m-4 4h16m-9 4h1m0 0v3\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":55},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M18 6L6 18M6 6l12 12\"\u002F>",{"slug":57,"title":58,"excerpt":59,"image":60,"publishedAt":61,"topics":62,"readMinutes":66,"html":67,"metaTitle":58,"metaDescription":68,"shareImage":69,"updatedAt":73,"author":74,"related":76},"chainguard-broke-the-php-embargo-by-six-hours-that-was-the-wrong-call","Chainguard Broke the PHP Embargo by Six Hours. That Was the Wrong Call","Chainguard shipped fixed PHP images more than six hours before the coordinated October 21 release, citing exploits in the wild. Here is how embargoes work, what Chainguard says, and why I still think releasing early was the wrong call for open source.","\u002Fcontent\u002Fimages\u002F2026\u002F10\u002Fhamburg-containers-julia-taubitz-unsplash.jpg","2026-10-22T16:00:00.000+08:00",[63],{"key":64,"label":65},"news","News",6,"\u003Cp>On October 21, PHP shipped 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two critical remote code execution bugs, CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4.0 9.2. Full unauthenticated remote code execution was demonstrated on Apache with mod_php with default settings, before any application code runs. On PHP-FPM, the Foundation reports remote code execution through application-level code paths, though the official \u003Ca href=\"https:\u002F\u002Fwww.openwall.com\u002Flists\u002Foss-security\u002F2026\u002F10\u002F21\u002F6?ref=ghost.jdneer.com\">oss-security advisory\u003C\u002Fa> says no complete FPM exploit was shown. I covered the release itself \u003Ca href=\"https:\u002F\u002Fghost.jdneer.com\u002F2026\u002F10\u002F21\u002Fphp-will-ship-emergency-fixes-for-two-critical-vulnerabilities-tonight\u002F\">here\u003C\u002Fa>, so this post is not about patching. If you run PHP and have not updated, stop reading and do that first. The \u003Ca href=\"https:\u002F\u002Fwww.php.net\u002F?ref=ghost.jdneer.com\">php.net advisory\u003C\u002Fa> has the versions and the interim mitigations.\u003C\u002Fp>\u003Cp>This post is about one decision during that release. According to the \u003Ca href=\"https:\u002F\u002Fthephp.foundation\u002Fblog\u002F2026\u002F10\u002F21\u002Ftodays-php-security-release-and-how-were-strengthening-php-security\u002F?ref=ghost.jdneer.com\">PHP Foundation\u003C\u002Fa>, Chainguard published built container images containing the fix on October 21 at 07:41 UTC (3:41 PM PHT). The coordinated release was set for 14:00 UTC (10 PM PHT). That is a gap of more than six hours. I think it was the wrong call, and I want to explain why without pretending the other side has no argument.\u003C\u002Fp>\u003Ch2 id=\"how-an-embargo-is-supposed-to-work\">How an embargo is supposed to work\u003C\u002Fh2>\u003Cp>When a serious bug is found in a widely used open-source project, the maintainers build a fix in private and share it ahead of time with the people who ship that software to users: Linux distributions, LTS vendors, image builders. Everyone agrees on a public date and time. Until then, nobody publishes anything that reveals the fix.\u003C\u002Fp>\u003Cp>The best-known version of this is the \u003Ca href=\"https:\u002F\u002Foss-security.openwall.org\u002Fwiki\u002Fmailing-lists\u002Fdistros?ref=ghost.jdneer.com\">distros and linux-distros mailing lists\u003C\u002Fa> run by Openwall. Their policy caps embargoes at 14 days and says members must not make embargoed information public, or even hint at it, until the agreed date or substantially complete publication by others. It goes further and says members must not share the information \"in any derived form (not even through delivering or deploying undocumented fixes).\" A built binary with the patch inside is exactly that kind of derived form.\u003C\u002Fp>\u003Cp>I am not claiming Chainguard was a member of that list or bound by its text. The PHP Foundation says only that Chainguard, \"like other distributors,\" had received the patch in advance. I cite the Openwall policy because it spells out the norm the whole ecosystem works under: you get early access so your users can update the moment disclosure happens, not before.\u003C\u002Fp>\u003Cp>The reason is simple. A fix is a map to the bug. Once patched code is public, in source or binary, anyone can diff it against the previous version and work backward to the vulnerability. Embargoes exist to make sure that map appears for everyone at the same time.\u003C\u002Fp>\u003Ch2 id=\"what-happened-on-october-20-and-21\">What happened on October 20 and 21\u003C\u002Fh2>\u003Cp>The Foundation's timeline, all from its \u003Ca href=\"https:\u002F\u002Fthephp.foundation\u002Fblog\u002F2026\u002F10\u002F21\u002Ftodays-php-security-release-and-how-were-strengthening-php-security\u002F?ref=ghost.jdneer.com\">post\u003C\u002Fa>:\u003C\u002Fp>\u003Cul>\u003Cli>Oct 20, around 15:00 UTC (11 PM PHT): the two CVE IDs leaked on forums and social media, with a wrong release time and a wrong CVSS score of 10.0. The real score is CVSS v4.0 9.2. No technical details leaked.\u003C\u002Fli>\u003Cli>Oct 20, 19:30 UTC (Oct 21, 3:30 AM PHT): PHP published its pre-announcement and moved the release up a day, to Oct 21 at 14:00 UTC, because distributors were still packaging.\u003C\u002Fli>\u003Cli>Around 20:00 UTC: Calif, one of the reporting firms, mistakenly published a proof-of-concept video. Copies circulated after it was deleted.\u003C\u002Fli>\u003Cli>Oct 21, 07:41 UTC (3:41 PM PHT): Chainguard published images containing the fix.\u003C\u002Fli>\u003Cli>Oct 21, 14:00 UTC (10 PM PHT): the coordinated release.\u003C\u002Fli>\u003C\u002Ful>\u003Cp>The Foundation says its security team inspected the PoCs that appeared after the leak and \"did not identify any functional exploits at the time of release.\" It also wrote that \"any attacker could now study the fix in binary form while every other PHP user was still waiting for the release.\"\u003C\u002Fp>\u003Ch2 id=\"chainguards-side\">Chainguard's side\u003C\u002Fh2>\u003Cp>Chainguard has not published a blog post or advisory about this as far as I can find. Its CEO, Dan Lorenc, has explained the decision in public, and his reasoning deserves a fair hearing.\u003C\u002Fp>\u003Cp>The patched images did not go unnoticed. A \u003Ca href=\"https:\u002F\u002Fnews.ycombinator.com\u002Fitem?id=50176665&ref=ghost.jdneer.com\">Hacker News commenter\u003C\u002Fa> pointed to them at 06:07 UTC on October 21, and Lorenc confirmed the decision in the same thread at 06:18 UTC. In that \u003Ca href=\"https:\u002F\u002Fnews.ycombinator.com\u002Fitem?id=50176735&ref=ghost.jdneer.com\">comment\u003C\u002Fa> he wrote: \"We've been working with the team on the coordinated disclosure, but I made the call to get these out early when exploits hit in the wild.\" He praised the maintainers, said Chainguard had tested the patch extensively, and said the images were free and would stay that way.\u003C\u002Fp>\u003Cp>He went further in an interview with \u003Ca href=\"https:\u002F\u002Fwww.theregister.com\u002Fsecurity\u002F2026\u002F10\u002F22\u002Fphp-blames-supply-chain-security-biz-chainguard-for-putting-entire-web-at-risk\u002F5304611?ref=ghost.jdneer.com\">The Register\u003C\u002Fa>. He said Chainguard learned \"something was coming in PHP\" from one of the researchers, then independently found the same bugs with an AI harness and a frontier model, and later helped the maintainers test the patches. He said other security vendors reported real-world exploitation, that he notified the PHP coordinated disclosure channel before shipping, and that the artifacts were open to anyone, not only customers. His summary: \"It's coordinated vulnerability disclosure, unless there's evidence of active exploits in the wild.\" Asked whether he would do anything differently, he said no.\u003C\u002Fp>\u003Cp>That position matches Chainguard's own \u003Ca href=\"https:\u002F\u002Fwww.chainguard.dev\u002Flegal\u002Fcoordinated-vulnerability-handling-policy?ref=ghost.jdneer.com\">Coordinated Vulnerability Handling Policy\u003C\u002Fa>, which reserves the right to shorten timelines if a vulnerability is under active exploitation, if details are already public, or in other exceptional situations, and promises to notify the reporter when it does.\u003C\u002Fp>\u003Cp>So this was not a careless leak. It was a deliberate call by someone who knows how embargoes work, made under real pressure, with a stated reason. I take that seriously.\u003C\u002Fp>\u003Ch2 id=\"why-i-still-think-it-was-the-wrong-call\">Why I still think it was the wrong call\u003C\u002Fh2>\u003Cp>First, the evidence, because it cuts both ways. Lorenc was not making it up. According to \u003Ca href=\"https:\u002F\u002Fwww.tenable.com\u002Fblog\u002Fphp2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote?ref=ghost.jdneer.com\">Tenable's FAQ\u003C\u002Fa>, Amazon Threat Intelligence observed a php2shell exploitation attempt against its honeypot network on October 17, four days before disclosure, and Cloudflare CTO Dane Knecht \u003Ca href=\"https:\u002F\u002Fx.com\u002Fdok2001\u002Fstatus\u002F2112811965735202970?ref=ghost.jdneer.com\">said on October 21\u003C\u002Fa> that Cloudflare was \"seeing early attacks emerging.\" At the same time, the Foundation says the PoCs it inspected after the leak were not functional at release time, and Amazon itself says it is unclear whether the October 21 attempts would have succeeded against real systems. Reasonable people can read that picture differently. That is exactly why I do not think one vendor should be the one reading it for everyone.\u003C\u002Fp>\u003Cp>Second, the math. If attackers already had working exploits, an early patch in one vendor's images helps that vendor's users and changes little for attackers. If they did not yet, a published binary fix hands them a shortcut. With about six hours left and the evidence still disputed, the coordinators were the ones in a position to weigh those two risks for everyone. Users of every other distribution were still waiting on the agreed time, and so was everyone building from source.\u003C\u002Fp>\u003Cp>Third, the decision belonged to the coordinators. Chainguard did notify the coordination group before shipping, and I give it credit for that. But notifying the group is not the same as getting agreement. PHP's own pre-announcement said it would release earlier if details became public or active exploit evidence appeared, and it had already moved the release up once that week to deal with the leak. If Chainguard had evidence of exploitation, the right move was to put it in front of the coordinators and push them to move the whole release earlier for everyone, not to ship alone.\u003C\u002Fp>\u003Cp>Fourth, trust is the whole system. Embargoes only work because maintainers can hand patches to downstream vendors and expect them to hold. Lorenc made the point better than I could in his July post, \u003Ca href=\"https:\u002F\u002Fwww.chainguard.dev\u002Funchained\u002Fsummer-of-clearinghouses?ref=ghost.jdneer.com\">Summer of Clearinghouses\u003C\u002Fa>: \"The fix is the map, so pre-disclosure protection extends exactly as far as the people you can vet and hold to an embargo.\" I agree with that line. If vendors start treating their own policy as overriding the project's schedule, maintainers will respond the only way they can: share less, share later, and with fewer people. That hurts every user, including Chainguard's.\u003C\u002Fp>\u003Ch2 id=\"what-i-would-like-to-see\">What I would like to see\u003C\u002Fh2>\u003Cp>Nobody here is a villain. The PHP security team owned its own failure in plain words: the fix stalled for months, and the Foundation called that \"a structural failure.\" Calif's video was a mistake. Chainguard made a judgment call under pressure. The leak of the CVE IDs started the chaos before any of them acted.\u003C\u002Fp>\u003Cp>A few things would help next time:\u003C\u002Fp>\u003Cul>\u003Cli>Embargo agreements should say up front what happens if exploitation is reported, who decides, and what evidence they need to see.\u003C\u002Fli>\u003Cli>A vendor that believes it must break an embargo should ask the coordinators to move the release for everyone first, and only act alone if that fails.\u003C\u002Fli>\u003Cli>Exploitation evidence used to justify an early release should go to the coordinators first, so they can decide for everyone, and be published afterward.\u003C\u002Fli>\u003Cli>Companies that depend on PHP should \u003Ca href=\"https:\u002F\u002Fthephp.foundation\u002Fsponsor?ref=ghost.jdneer.com\">fund the PHP Foundation\u003C\u002Fa>, so the security team is not stretched this thin when the next one lands.\u003C\u002Fli>\u003C\u002Ful>\u003Cp>AI tools are making it faster to find bugs and faster to turn a patch into an exploit. Lorenc said as much himself. That is the strongest argument for holding embargoes more tightly, not loosening them. The few hours between a fix existing and a fix being public are now worth more than they used to be, and they only protect anyone if everyone holds the line together.\u003C\u002Fp>\u003Ch2 id=\"sources\">Sources\u003C\u002Fh2>\u003Cul>\u003Cli>\u003Ca href=\"https:\u002F\u002Fthephp.foundation\u002Fblog\u002F2026\u002F10\u002F21\u002Ftodays-php-security-release-and-how-were-strengthening-php-security\u002F?ref=ghost.jdneer.com\">PHP Foundation: Today's PHP Security Release, and How We're Strengthening PHP Security\u003C\u002Fa>\u003C\u002Fli>\u003Cli>\u003Ca href=\"https:\u002F\u002Fwww.php.net\u002F?ref=ghost.jdneer.com\">php.net: Security advisory, Oct 21, 2026\u003C\u002Fa>\u003C\u002Fli>\u003Cli>\u003Ca href=\"https:\u002F\u002Fwww.openwall.com\u002Flists\u002Foss-security\u002F2026\u002F10\u002F21\u002F6?ref=ghost.jdneer.com\">oss-security: CVE-2026-109618 announcement\u003C\u002Fa>\u003C\u002Fli>\u003Cli>\u003Ca href=\"https:\u002F\u002Foss-security.openwall.org\u002Fwiki\u002Fmailing-lists\u002Fdistros?ref=ghost.jdneer.com\">Openwall: distros and linux-distros list policy\u003C\u002Fa>\u003C\u002Fli>\u003Cli>\u003Ca href=\"https:\u002F\u002Fwww.chainguard.dev\u002Flegal\u002Fcoordinated-vulnerability-handling-policy?ref=ghost.jdneer.com\">Chainguard: Coordinated Vulnerability Handling Policy\u003C\u002Fa>\u003C\u002Fli>\u003Cli>\u003Ca href=\"https:\u002F\u002Fnews.ycombinator.com\u002Fitem?id=50176735&ref=ghost.jdneer.com\">Hacker News: Dan Lorenc comment, Oct 21, 2026\u003C\u002Fa>\u003C\u002Fli>\u003Cli>\u003Ca href=\"https:\u002F\u002Fwww.theregister.com\u002Fsecurity\u002F2026\u002F10\u002F22\u002Fphp-blames-supply-chain-security-biz-chainguard-for-putting-entire-web-at-risk\u002F5304611?ref=ghost.jdneer.com\">The Register: PHP blames supply chain security biz Chainguard\u003C\u002Fa>\u003C\u002Fli>\u003Cli>\u003Ca href=\"https:\u002F\u002Fsocket.dev\u002Fblog\u002Fphp-embargo-dispute?ref=ghost.jdneer.com\">Socket: PHP Foundation Says Chainguard Broke Security Embargo\u003C\u002Fa>\u003C\u002Fli>\u003Cli>\u003Ca href=\"https:\u002F\u002Fwww.chainguard.dev\u002Funchained\u002Fsummer-of-clearinghouses?ref=ghost.jdneer.com\">Chainguard (Dan Lorenc): Summer of Clearinghouses, July 5, 2026\u003C\u002Fa>\u003C\u002Fli>\u003Cli>\u003Ca href=\"https:\u002F\u002Fnews.ycombinator.com\u002Fitem?id=50176665&ref=ghost.jdneer.com\">Hacker News: comment noting patched Chainguard PHP images, 06:07 UTC Oct 21, 2026\u003C\u002Fa>\u003C\u002Fli>\u003Cli>\u003Ca href=\"https:\u002F\u002Fwww.tenable.com\u002Fblog\u002Fphp2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote?ref=ghost.jdneer.com\">Tenable: php2shell FAQ (Amazon and Cloudflare exploitation reports)\u003C\u002Fa>\u003C\u002Fli>\u003Cli>\u003Ca href=\"https:\u002F\u002Fx.com\u002Fdok2001\u002Fstatus\u002F2112811965735202970?ref=ghost.jdneer.com\">Dane Knecht (Cloudflare) on X, Oct 21, 2026\u003C\u002Fa>\u003C\u002Fli>\u003C\u002Ful>","Chainguard shipped fixed PHP images more than six hours before the coordinated October 21 release, citing exploits in the wild. Here is how embargoes...",{"src":60,"height":70,"width":71,"type":72},1333,2000,"image\u002Fjpeg","2026-10-24T16:08:54.000+08:00",{"name":75,"url":10,"owner":5},"JD Bungart",[77,86,97,105],{"slug":78,"title":79,"excerpt":80,"image":81,"publishedAt":82,"topics":83,"readMinutes":85},"rakazo-v0-3-3-self-hosted-grok-bot-alternative","Rakazo v0.3.3: What's New in the Self-Hosted Grok Bot Alternative","Rakazo, the open source, self-hostable AI agent platform, shipped v0.3.3 on October 22. A small release: delete chats on mobile, Telegram replies with images and files, and a handful of fixes.","\u002Fcontent\u002Fimages\u002F2026\u002F10\u002Frakazo-readme-hero-1280x720.png","2026-10-24T18:00:00.000+08:00",[84],{"key":64,"label":65},1,{"slug":87,"title":88,"excerpt":89,"image":90,"publishedAt":91,"topics":92,"readMinutes":85},"dito-cme-board-changes-2026","DITO CME elects four new directors at annual stockholders' meeting","DITO CME Holdings elected Oozi Cats, Xinxin Wang, Enrique Pampolina and Cenon Audencial Jr. to its board, as Eric Recto and Salvador Medialdea ended their terms.","\u002Fcontent\u002Fimages\u002F2026\u002F10\u002Fdito-board-boardroom-pavel-gromov-unsplash.jpg","2026-10-24T08:00:00.000+08:00",[93,96],{"key":94,"label":95},"philippines","Philippines",{"key":64,"label":65},{"slug":98,"title":99,"excerpt":100,"image":101,"publishedAt":102,"topics":103,"readMinutes":85},"downfall-of-bgp-exchange","The downfall of bgp.exchange: how a volunteer peering exchange lost its domain, mail and management plane in a day","In September 2026 a volunteer peering exchange lost its domain, mail and management plane in about a day. A timeline from public records.","\u002Fcontent\u002Fimages\u002F2026\u002F10\u002Fbgpx-fiber-switch.jpg","2026-10-23T12:00:00.000+08:00",[104],{"key":64,"label":65},{"slug":106,"title":107,"excerpt":108,"image":109,"publishedAt":110,"topics":111,"readMinutes":85},"a-third-of-philippine-businesses-now-use-ai-but-only-17-have-a-plan-to-scale-it","A Third of Philippine Businesses Now Use AI, but Only 17% Have a Plan to Scale It","An AWS-commissioned study says 32% of Philippine businesses now use AI, up from 21% a year ago. But only 17% have a roadmap to scale it, and just 19% feel ready for agentic AI. Skills remain the biggest gap. Here are the numbers that matter.","\u002Fcontent\u002Fimages\u002F2026\u002F10\u002Fteam-laptops-cherrydeck-unsplash.jpg","2026-10-22T18:00:00.000+08:00",[112,113],{"key":94,"label":95},{"key":64,"label":65},{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":115},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M5 12h14M5 12l6 6m-6-6l6-6\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":117},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"M6.5 7.5a1 1 0 1 0 2 0a1 1 0 1 0-2 0\"\u002F>\u003Cpath d=\"M3 6v5.172a2 2 0 0 0 .586 1.414l7.71 7.71a2.41 2.41 0 0 0 3.408 0l5.592-5.592a2.41 2.41 0 0 0 0-3.408l-7.71-7.71A2 2 0 0 0 11.172 3H6a3 3 0 0 0-3 3\"\u002F>\u003C\u002Fg>"]