CISA acting associate director for vulnerability management Jay Gazlay criticized Chainguard’s early PHP patches at a Red Hat conference in Washington, D.C., on October 28. The PHP Foundation said Chainguard released the patches more than six hours before the coordinated disclosure planned for October 21.
Why the release timing drew criticism
Coordinated vulnerability disclosure gives selected security firms advance information so they can prepare patches for release alongside a public announcement. The PHP Foundation said an early release could let attackers study the fix while other PHP users were still waiting for their patches.
Chainguard’s CEO, Dan Lorenc, defended the decision by pointing to information already circulating, the company’s ability to find the flaw and build an exploit independently, and evidence of malicious activity. The PHP Foundation said some vulnerability information had leaked in the two days before the planned disclosure.
NeoTeo previously covered PHP’s release of fixes for two critical vulnerabilities.
What the exploitation reports describe
The different indicators refer to different activity and stages. AWS research reportedly identified attempted exploitation dating to October 17. The PHP Foundation said its security team had not identified a functional exploit at public disclosure. Jay Gazlay said CISA analysts generated a working proof of concept inside CISA’s own infrastructure after studying the vulnerability with models for multiple days.
A working exploit was reportedly confirmed several days after public disclosure. CISA reportedly added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog on October 26. Joe Slowik of Dataminr said he had seen no public evidence supporting Chainguard’s early release and assessed that the flaw had not been weaponized at scale when he commented.
Does a KEV listing mean an exploit is easy or that successful attacks are widespread? No. A listing, reports of attempted exploitation, a working proof of concept, and the scale of successful attacks are separate indicators.
Why security professionals disagreed
Lorenc argued that Chainguard had reason to act before proof of successful exploitation, citing evidence of malicious activity and the information already in circulation. Slowik disputed that the public evidence justified releasing patches early, but opposed excluding Chainguard from future disclosure discussions. He described the incident as a judgment call the industry could learn from.
The disagreement is also about the rules for acting before a coordinated release. Lorenc called for clearer criteria and stronger coordination, while ArmorCode’s Ramy Rahman argued for balance and collaboration among the organizations involved.
