Chainguard Breaks Embargo, Ships PHP Patch Over Six Hours Early

On October 21 at 07:41 UTC, Chainguard released container images containing a PHP security patch more than six hours ahead of the agreed coordinated disclosure. The early release gave attackers a window to reverse-engineer the binary fix while the wider PHP user base remained unprotected.

• Patch published Oct 21 at 07:41 UTC, over 6 hours before embargo lift
• Chainguard container images made the binary patch publicly available
• Other PHP users stayed vulnerable until the official disclosure
• Disclosure embargoes rely on trust with no enforceable penalties