Chainguard CEO Says Suspected Exploitation Prompted Early PHP Disclosure
Photo: TokenPost
Chainguard CEO Dan Lorenc said he shared information early because he believed attackers were exploiting PHP flaws, putting the timing of coordinated disclosure under scrutiny. Chainguard published images containing fixes at 3:41 a.m. ET (0741 UTC) Wednesday, Oct. 21, 6 hours and 19 minutes before PHP’s coordinated 10 a.m. ET (1400 UTC) release. The PHP Foundation said Chainguard had received the patch in advance and called the early publication an embargo breach. The schedule had already shifted after the vulnerability identifiers began circulating around 11 a.m. ET (1500 UTC) Tuesday, Oct. 20.
Source: TokenPost
