I kinda get Chainguard's position here. They were part of the embargo, saw exploits hitting in the wild already and decided to release rather than hold things back.

Embargos make sense if no one is exploiting it yet, but if its out in the wild, the best path forward is releaseing as soon as possible.

▲

dannyw a day ago | parent | next [-]

Did they actually see exploits in the wild? The PHP Foundation team disputes this, and say they didn't observe any working PoC capable of an exploit.

▲

danso a day ago | parent | next [-]

The person who wrote the widely-referred-to tweet last night (claiming to "have recreated & lab/field tested CVE-2026-109618 / CVE-2026-109619") followed up a couple hours later and said that their POC had not been proven to work "in the wild"

[0] https://x.com/J4ck3LSyN/status/2112703096443097263

[1] https://x.com/J4ck3LSyN/status/2112753673235501137

	▲	nicce a day ago \| parent \| next [-]
		The whole post looked to be vibecoded and the code did not even match the claims
	▲	bawolff a day ago \| parent \| prev [-]
		As far as i know they lied and are now retracting their claims. What they posted was not consistent with the details of the real bug.

▲

skrrtww a day ago | parent | prev | next [-]

Cloudflare's blog post announcing its updated WAF rules directly implies the existence of in-the-wild exploits: https://blog.cloudflare.com/php-vulnerabilities-waf-protecti...

"Cloudflare successfully deployed multiple mitigations for all its customers while the vulnerability was leaked before the official release date and we observed attack traffic targeting our customers."

If that's not an in-the-wild exploit, it literally couldn't have been further away than one or two more iterations.

▲

snowwrestler a day ago | parent | next [-]

Attack traffic doesn’t necessarily mean the attacks were, or would have, succeeded.

From Cloudflare’s perspective, there is no downside to saying what they observed, and deploying defenses.

We may never know if this was actually being successfully exploited prior to patch availability.

▲

charcircuit a day ago | parent [-]

You shouldn't wait until the attacks succeed to start deploying defenses.

	▲	cryptonym 12 hours ago \| parent [-]
		Unless you are on embargo and don't want to give more details to attackers. Seeing specific requests being blocked is very valuable information about upcoming vulnerabilities. If you own a website and see what kind of requests are denied by your Edge/Cloud provider, you can easily gather details and deduce which tools and specific features are broken. With deontology, you prepare the rules and wait for the embargo to be lifted and don't overdo it on fear marketing. Of course if things are getting sideway and people starts leaking details, that's another story.

▲

bawolff a day ago | parent | prev [-]

That sounds like cloudflare trying to reassure paranoid customers. I think its a reach to go from that statement to actual in the wild exploits.

▲

a day ago | parent | prev | next [-]

[deleted]

▲

gjsman-1000 a day ago | parent | prev [-]

Chainguard most likely interpreted Calif's dancing anime girl video as a script kiddie who had found a POC.

	▲	arm32 a day ago \| parent \| next [-]
		Can you blame them? Calif's unbelievably unprofessional video's leak definitely spikes the cortisol of any actual professional.
	▲	dannyw a day ago \| parent \| prev \| next [-]
		It sounds like there was no "co-ordination" behind any of this co-ordinated disclosure. You'd have expected there to be an IRC channel, a mailing list, a Slack chat, or something for something of this scale. Was there even an incident co-ordinator here? Was any of the parties talking to each other?
	▲	SiempreViernes a day ago \| parent \| prev [-]
		And then decided to not ask the PHP foundation about it?

▲

rskeens a day ago | parent | prev [-]

Many people actively following would have 403'ed multiparts so people seeing those blocked might have assumed it started being exploited early instead of probes / background noise.