{
  "id": 19680237,
  "title": "Chainguard defends its choice to break the PHP security embargo: “We own the decision.”",
  "url": "https://urgent.news/2026/11/12/chainguard-defends-its-choice-to-break-the-php-security-embargo-we",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-12T17:03:25.000Z",
  "source": {
    "name": "The New Stack",
    "slug": "the-new-stack",
    "url": "https://thenewstack.io/chainguard-php-embargo-defense/"
  },
  "original_language": "en",
  "account": "At KubeCon + CloudNativeCon North America 2026, Chainguard's co-founder and CTO Matt Moore defended the company's decision to release patched PHP images before the agreed-upon embargo with other partners had lifted. This move came under scrutiny when PHP's maintainers accused Chainguard of giving attackers a head start. Moore clarified that Chainguard possessed the decision-making authority and was not influenced by external pressures. He elaborated on discussions with other stakeholders and reported findings from security vendors, indicating that attackers might already be exploiting the vulnerabilities. The two key issues, CVE-2026-109618 and CVE-2026-109619, were serious memory management and error-handling flaws that could allow an unauthenticated attacker to execute code on a PHP server. These vulnerabilities were classified as critical under the Common Vulnerability Scoring System (CVSS) v4.0. Chainguard's decision was based on the belief that attackers could already exploit the bugs or were close to doing so, and that withholding fixes could reverse the advantage gained from the embargo.",
  "summary": "At KubeCon + CloudNativeCon North America 2026 this week, Chainguard co-founder and CTO Matt Moore defended the company’s decision to The post Chainguard defends its choice to break the PHP security embargo: “We own the decision.” appeared first on The New Stack .",
  "key_points": [
    "Chainguard CEO Matt Moore defends releasing PHP patches early",
    "PHP maintainers accuse Chainguard of giving attackers head start",
    "CVE-2026-109618 and CVE-2026-109619 are critical memory management flaws"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}