Today's PHP Security Release, and How We're Strengthening PHP Security

ernubufiei 3 minutes ago | parent | next [-]

> On October 21st at 07:41 UTC, more than six hours before the coordinated release, Chainguard unilaterally broke the embargo and published built images containing the fix.

This is incredibly damming of Chainguard. I struggle to see justification for this, even with the chaos approaching the coordinated release.

	▲	n42 a few seconds ago \| parent [-]
		it should be the end of the company.

▲

bowersbros 18 minutes ago | parent | prev | next [-]

Step 1: Ensure that docker images are available when the embargo is released. We're 2 hours in, and they still aren't available.

	▲	lol768 a minute ago \| parent \| next [-]
		The PHP Foundation should manage it, the Docker ""Official" Images" approach clearly just doesn't work properly for responding to vulnerability patches.
	▲	eqmvii 4 minutes ago \| parent \| prev \| next [-]
		Yep, all our efforts are now focused on working around that. It's pretty neat!
	▲	Droobfest 3 minutes ago \| parent \| prev \| next [-]
		Never using docker hub ever again
	▲	thinkindie 17 minutes ago \| parent \| prev [-]
		today I learned that building your image from scratch is fundamental in cases like this. Luckily I came prepared thanks to Claude Code suggestion.

▲

dannyw 22 minutes ago | parent | prev | next [-]

> As a result of the leak and pre-announcement around 20:00 UTC, Calif, one of the security firms that had reported the issues mistakenly published a video.

This is the most surprising part to me. It sounds like Calif saw the leaks, interpreted that as embargo being broken, and then raced to publish their marketing video? I'd have expected much better.

▲

bombcar a minute ago | parent | next [-]

This is EXACTLY how marketing/pr firms actually coordinate no matter what they SAY.

▲

yreg 18 minutes ago | parent | prev [-]

This is not the dancing anime girl video, is it?

	▲	atymic 16 minutes ago \| parent [-]
		That's the one

▲

ChrisArchitect 2 minutes ago | parent | prev | next [-]

PHP2Shell: AI uncovers critical RCE in PHP

https://news.ycombinator.com/item?id=50180836

Patch the Planet: global response coordination as agents uncover critical vulnerabilities

https://news.ycombinator.com/item?id=50181175

Upcoming critical PHP security release (CVE-2026-109618 / -109619)

https://news.ycombinator.com/item?id=50172041

▲

ck2 a minute ago | parent | prev | next [-]

serious question

for legacy systems, how difficult would it be for an attacker assisted by "AI" to stage the conditions

on a scale of 1 (easiest) to 10 (hardest)

▲

nicce 14 minutes ago | parent | prev | next [-]

What is the penalty of breaking the embargo? Not shipping patches anymore beforehand?

	▲	dannyw 10 minutes ago \| parent [-]
		It might make other projects reconsider sharing advanced patches with Chainguard.

▲

cubefox 38 minutes ago | parent | prev [-]

Sounds like a lot went wrong, the 2024 issue not being patched and then multiple parties leaking stuff before the scheduled release date.