Source: socket.dev
The PHP Foundation published a postmortem accusing Chainguard of breaking a coordinated security embargo by releasing patched PHP container images over six hours before the scheduled disclosure of two critical RCE vulnerabilities (CVE-2026-109618 and CVE-2026-109619). Chainguard CEO Dan Lorenc defended the early release citing active exploitation reports from multiple security vendors and the ease of independently discovering the vulnerability. The disclosure process was further disrupted by leaked CVE identifiers, an accidentally published exploit demonstration video by Calif, and potentially leaked mitigation guidance. The underlying memory management vulnerability had been known since a 2024 Quarkslab audit but stalled due to complex trade-offs and limited developer resources. Researchers from Calif, OpenAI, and Wiz contributed to identifying attack vectors and RCE proofs of concept. PHP's security team is now moving to majority-vote decisions to prevent fixes from stalling, and the Foundation is calling for increased funding from companies dependent on PHP. The incident raised community concerns about whether other projects would trust Chainguard with embargoed patches in the future.
