Shame on Chainguard for breaking the embargo in the final 24h window. They should lose their embargo privileges.
> On October 21st at 07:41 UTC, more than six hours before the coordinated release, Chainguard unilaterally broke the embargo and published built images containing the fix. ... This disregarded weeks of work by many parties toward a coordinated disclosure.
Oct 21, 2026, 9:21 PM@ehashman Almost as if they are… the weakest link in the chain
@ehashman what are your feelings on their "exploitation in the wild" excuse? I don't have a dog in this fight but I feel like this is the one thing AI can do really well - massively reduce the "hint of the general location of a defect" / "active exploitation" window, to the point where almost every bad vuln is now going to have drama like this associated with it
@glyph complete nonsense. Amazon detected exploitation 4 days before embargo lift and didn't break the embargo. By breaking the embargo, they exposed far more people to exploitation, likely including their own customers.
https://www.wired.com/story/hackers-exploited-the-php-vulnerabilities-days-before-they-were-patched/
@ehashman is he just making up the purported exception? is the exception bad and shouldn't be there? or is this a case which is technically valid but any practitioner should know that it wasn't at a scale where the exception _should_ have applied so he was within his rights but has horrible judgment?
@glyph as far as I can tell he's just making this shit up. There is no acceptable reason to unilaterally break an embargo. I was an embargo contact for a couple years at Red Hat and I had to take a training, sign a bunch of extra documents, and they took it EXTREMELY seriously. Even mentioning you were "working on a security thing" with no further details *internally* was frowned upon if it was embargoed
@ehashman good to know. I have seen embargoes with less severe terms than that and some policy affordances for breaking them, but I've (obviously?) never been remotely close to breaking that particular glass. c.f. https://github.com/CERTCC/Vultron/issues/2052
@ehashman oops wrong link. I meant https://certcc.github.io/CERT-Guide-to-CVD/howto/coordination/active_exploitation/