Chainguard defends its choice to break the PHP security embargo: “We own the decision.”

Chainguard CTO Matt Moore explains why the company released patched PHP container images about six hours before a coordinated October 21 security release, despite objections from PHP's maintainers, who said the early release gave attackers a head start. He argues that other embargo participants and security vendors had already seen signs of exploitation, so the confidentiality advantage the embargo was meant to protect had eroded. The article also covers the technical background of the two PHP2Shell bugs, which PHP's advisories rate critical at 9.2 under CVSS v4.0. The piece traces how the disclosure process fell apart, including leaked CVE details and an accidentally published proof-of-concept video. It notes that Amazon and Cloudflare reported attack activity before Chainguard's release, while stressing that exploitability depends on the PHP build, server configuration, and application. The text shown ends before the article's closing analysis, so the final verdict on the decision is not included.