PHP blames supply chain security biz Chainguard for putting huge chunks of the web at risk
'Coordinated vulnerability disclosure, unless there's evidence of active exploits in the wild,' Chainguard CEO tells The Reg
PHP developers have accused security software supplier Chainguard of inadvertently exposing critical bugs in the widely-used open-source scripting language PHP before an official disclosure. The vulnerabilities, collectively known as PHP2shell, can allow unauthorized attackers to execute code on servers running PHP, posing a significant risk given PHP's role in powering a large portion of the public web.
The disclosure occurred after PHP maintainers found and fixed the vulnerabilities between August and September, crediting researchers from Calif, OpenAI, and Wiz for their discovery. PHP developers claim the issues began when rumors about the vulnerabilities started circulating on social media and online forums on Tuesday, leading PHP to preemptively warn users about the potential security flaws and push the official disclosure forward by a day from Thursday to Wednesday.
Chaingguard, however, published a proof-of-concept exploit and additional, though limited, information about the bugs on Wednesday, six hours before the coordinated release, disregarding weeks of work by multiple parties to coordinate the disclosure. Chainguard CEO Dan Lorenc told The Register that his company didn't leak the information but rather found the vulnerabilities independently using AI models, stating that the process of coordinating vulnerability disclosures can be messy.
Written by urgent.news from The Register Science's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
This story
This is one outlet's version. Read the fullest account.
