Replies

• 

  catchcatch56@kolektiva.social

  Oct 22, 2026, 6:25 AM

  @joepie91 @hembrow that's the one. With more funding or a different set of events, they might have fixed it before any exploit was discovered within the past couple of years, then most installations would have been secure today. Probably it wouldn't have got backported to older PHP versions because itnwoukd have been deemed less serious. So if the exploit still got found later, it have affected a smaller subset of sites this week, and possibly worse, but a lot more would have been OK without doing anything.

  💬 0🔄 0⭐ 4
• 

  ByteByte@rage.love

  Oct 22, 2026, 6:27 AM

  @joepie91 @hembrow which part of that blog post is the previously known but not previously practical part?

  💬 1🔄 0⭐ 0
• 

  ByteByte@rage.love

  Oct 22, 2026, 6:27 AM

  @joepie91 @hembrow also:

  > On October 21st at 07:41 UTC, more than six hours before the coordinated release, Chainguard unilaterally broke the embargo and published built images containing the fix.

  Ugh.

  💬 0🔄 0⭐ 0