Chainguard defends its choice to break the PHP security embargo: “We own the decision.”

At KubeCon + CloudNativeCon North America 2026, Chainguard's co-founder and CTO Matt Moore defended the company's decision to release patched PHP images before the agreed-upon embargo with other partners had lifted. This move came under scrutiny when PHP's maintainers accused Chainguard of giving attackers a head start. Moore clarified that Chainguard possessed the decision-making authority and was not influenced by external pressures.

He elaborated on discussions with other stakeholders and reported findings from security vendors, indicating that attackers might already be exploiting the vulnerabilities. The two key issues, CVE-2026-109618 and CVE-2026-109619, were serious memory management and error-handling flaws that could allow an unauthenticated attacker to execute code on a PHP server.

These vulnerabilities were classified as critical under the Common Vulnerability Scoring System (CVSS) v4.0. Chainguard's decision was based on the belief that attackers could already exploit the bugs or were close to doing so, and that withholding fixes could reverse the advantage gained from the embargo.