Oct 22, 2026, 1:00 PM(4/5)
💵 PHP runs over half the Internet, including governments and multibillion-dollar corporations, yet the foundation behind it has a budget under $1m and only 13 engineers, some part-time. Despite this, they handled one of the hardest vulnerabilities in recent years with professionalism. They deserve better: if your company or government relies on PHP, consider supporting them.
Oct 22, 2026, 1:00 PM(5/5)
🏛️ Governments must recognise that the Open Source they depend on is underfunded for the wave of AI-discovered vulnerabilities it faces. The EU's CRA partially addresses this by making companies more responsible; its Open Source Software Stewards & Voluntary Security Attestations should channel funding from corporate and government users to the projects themselves.
Oct 22, 2026, 1:04 PMBonus thought: This comment on the #PHP blog alleges that Chainguard, the organisation who broke embargo and leaked the patch early, is currently using this to try to expand their customer base.
If these allegations are true, it's difficult to say how #Chainguard should still be allowed access to pre-disclosure information. If this happens again, the whole responsible disclosure system is at risk of collapse.
Oct 22, 2026, 1:04 PMSecond Bonus thought, a big thank you to the @php foundation and to all PHP's developers for their hard work. We love you guys ❤️
Oct 22, 2026, 1:10 PMFinal bonus thought: I deploy and manage PHP for a few clients I provide hosting to. It's not exactly a business, I probably make about €10 a month from it, but it's only possible thanks to the work of the PHP foundation and PHP devs.
So I'm going to put my money where my mouth is, sacrifice one Brussels-priced coffee a month, and support of the PHP foundation!
Thanks for the insights.
@jmaris If probably never do any business with a company with this morale.
Oct 22, 2026, 1:14 PM@rpsu If the allegation is true, I agree. I am cautious, but their post explaining their actions doesn't exactly fill me with a belief that they are an ethical company.
If I were the PHP foundation, I'd be considering excluding them from pre-disclosure coordination.
Oct 22, 2026, 5:02 PM@jmaris @rpsu since the CEO of Chainguard has been openly and proudly talking about breaking the embargo and trying to paint themselves as some sort of saviour, I'd say that that should be sufficient reason by itself to exclude them from future coordinated disclosures on any project *and* to not do any business with them. they clearly do not have any respect for the people they work with. regardless of what their sales team does...
Oct 22, 2026, 5:16 PM