This to me is an interesting part of the overall PHP shenanigans, which wants looking at before "the next one" so to speak.
PHP Foundation explanation post:
"On October 21st at 07:41 UTC, more than six hours before the coordinated release, Chainguard unilaterally broke the embargo and published built images containing the fix. Like other distributors, Chainguard had received the patch in advance so its users could update the moment the vulnerabilities were disclosed. Any attacker could now study the fix in binary form while every other PHP user was still waiting for the release. This disregarded weeks of work by many parties toward a coordinated disclosure." https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/
Dan Lorenc, CEO of Chainguard, attempting to defend their defection:
"... several of the other security vendors in the process confirmed seeing exploits in the wild."
https://topspicy.social/@alda/117481196855767525
(via @alda - thanks)
Nils Adermann, writer of the original statement:
"This is false. There were no confirmed exploits. All that was reported on the Slack channel you are referring to, was people probing, trying to exploit. At the time of release today, there was still no report of actually successful exploitation.
"There was a clear embargo until the time of disclosure and public release, that was discussed and evaluated repeatedly as information arrived, weighing the risk of exploitation vs protection from publishing patches without complete updates.
"The decision you took unilaterally without any communication with the PHP team was both irresponsible and unprofessional. The proper thing to do here is apologize, not to justify your clear misbehavior."
https://topspicy.social/@alda/117481241639601952