Chainguard Breaks PHP Patch Embargo Early

Chainguard CEO Dan Lorenc released patched container images more than six hours before the October 21 coordinated release, arguing active exploitation justified breaking the embargo. The PHP Foundation criticized this unilateral move, stating it gave attackers time to study the fix while other users waited for patches during the PHP2Shell emergency involving CVE-2026-109618 and CVE-2026-109619.