The PHP maintainers accuse Chainguard of breaking an embargo surrounding two critical vulnerabilities. The company published patched images more than six hours before the coordinated disclosure. CEO Dan Lorenc does not dispute the timeline but denies that Chainguard leaked anything.
Researchers from Calif, OpenAI, and Wiz discovered the vulnerabilities between August and September. All three used AI models in their research. According to Wiz, the vulnerabilities involve memory corruption, including use-after-free. The researchers demonstrated pre-auth remote code execution against platforms such as WordPress, Drupal, and Joomla.
Yesterday, a few hours after the emergency patches were released, the PHP maintainers published a blog post about the discovery and the fix. It also includes a section about a leak and a disrupted disclosure.
Rumors, a video, and early images
According to the maintainers, it began on Tuesday around 3:00 p.m. UTC. At that time, two CVE numbers circulated on forums and social media, along with incorrect information about the release time and CVSS score. No technical details were leaked at that time. Nevertheless, the team moved the announcement up by one day, from Thursday to Wednesday. This was because distributors were still in the process of packaging the fix, releasing it immediately would have left many users without an easy way to update.
Shortly thereafter, Calif accidentally published a video featuring a proof-of-concept exploit. Mitigation advice provided to several unnamed parties in critical infrastructure may also have been leaked.
The maintainers then point the finger at Chainguard. That company published images containing the fix on Wednesday at 7:41 a.m. UTC, more than six hours before the coordinated release. Like other distributors, Chainguard had received the patch in advance. “Any attacker could now study the fix in binary form while every other PHP user was still waiting for the release,” the maintainers write.
Chainguard denies leak
Chainguard actually focuses on securing the software supply chain. CEO Dan Lorenc told The Register that his company did not leak anything. Chainguard heard from one of the researchers on Friday that something was coming in PHP. That same evening, the team found the same vulnerabilities using its own AI harness and a frontier model. A simple prompt to find serious vulnerabilities in PHP was enough, Lorenc wrote on LinkedIn. Starting Saturday, Chainguard collaborated with the maintainers and helped test the patches.
“The patches are crazy – this is not a simple vulnerability,” Lorenc said. According to him, it actually took the maintainers months to build a working patch.
Tip: PHP brings the internet to a standstill: why PHP2Shell affects every company