Chainguard unilaterally released security patches for PHP more than six hours before the coordinated disclosure, which the PHP Foundation criticized as disregarding weeks of collaborative work.

The PHP Foundation says Chainguard unilaterally broke the embargo and published built images containing the critical RCE fixes more than six hours early: “This disregarded weeks of work by many parties toward a coordinated disclosure.” https://socket.dev/blog/php-embargo-dispute

"More than six hours before the coordinated release, Chainguard unilaterally broke the embargo and published built images containing the fix. Like other distributors, Chainguard had received the patch in advance so its users could update the moment the vulnerabilities were disclosed. Any attacker could now study the fix in binary form while every other PHP user was still waiting for the release. This disregarded weeks of work by many parties toward a coordinated disclosure." Fucking assholes.

The PHP Foundation says Chainguard unilaterally broke the embargo and published built images containing the critical RCE fixes more than six hours early: “This disregarded weeks of work by many parties toward a coordinated disclosure.” https://socket.dev/blog/php-embargo-dispute