The PHP Foundation has blamed Chainguard for breaking the embargo before patches for the PHP2Shell vulnerabilities were ready to be shipped.
PHP blog post: https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/
Chainguard response: https://lnkd.in/p/eQnxwTqw
thephp.foundationToday's PHP Security Release, and How We're Strengthening PHP SecurityDescribing the story behind how critical security vulnerabilities were found and fixed.