A CISA official called Chainguard’s decision to release patches for newly disclosed PHP bugs more than six hours before the coordinated release “dangerous” and “inappropriate.” The PHP Foundation said the early release let attackers study the fix in binary form while most PHP users were still waiting, undermining weeks of coordinated disclosure work. Chainguard CEO Dan Lorenc defended the move, citing easy independent discovery, existing public information, and evidence of active exploits “in the wild.” The PHP Foundation noted no functional exploits were identified at the time of public disclosure, and critics argue the evidence was insufficient to break the embargo set for Oct. 21. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on Oct. 26, and acting associate director Jay Gazlay warned that tolerating embargo breaks could encourage repeat behavior. 1