When Chainguard shipped patched PHP container images more than six hours ahead of an October 21 coordinated security release, PHP's maintainers accused the company of giving attackers a head start. Chainguard argues attackers already had one.
Chainguard founder and CTO Matt Moore In an interview with The New Stack, Moore said, "We own the decision that we chose to do it. Nobody could force us to do it — but we did not do it in a vacuum."
He also described, in discussions with TNS, other participants in the embargo and security vendors' reports of activity targeting the vulnerabilities before Chainguard released its images. Chainguard was not saying that they patched it faster so they shipped it first.
According to Moore, Chainguard believed attackers could already exploit the bugs, or were at least close to figuring out how — or were trying to figure it out. The two vulnerabilities, CVE-2026-109618 (out-of-memory corruption) and CVE-2026-109619 (stale global state), collectively known as PHP2Shell, were serious memory-management and error-handling flaws. Under the right conditions, an unauthenticated attacker could execute code on a PHP server.
