fwiw it looks like the patches were made available early on chainguard

https://images.chainguard.dev/directory/image/php/versions

How does it work that some service that most people never heard of distributes (paid) images with alleged fix for vuln 24h before official vuln fix/image is available? Seems somewhat shady.

▲

windowsworkstoo a day ago | parent [-]

thats chainguard’s entire value prop (they are quite well known in this sphere)

	▲	jsploit a day ago \| parent [-]
		Good luck getting them to fix broken packages though.

▲

kassner a day ago | parent | prev [-]

Is there a public announcement? I can only see PHP 8.5.11 images, but having a recent build date is not enough to say they are indeed patched.

	▲	ibejoeb a day ago \| parent [-]
		context: https://news.ycombinator.com/item?id=50176735