⛓️💥 More About the Recent PHP Vulnerabilities
The PHP Foundation in a blog post titled, "Today's PHP Security Release, and How We're Strengthening PHP Security":
This post isn't about how to update. It's about how these vulnerabilities were found and fixed, what has changed in how PHP security is handled over the past two years, and what we need from the organizations that depend on PHP to keep PHP's security work going.
They provide a lot of details about the history of these vulnerabilities and the timeline leading up to exploration and the patches.
I found this part particularly interesting:
On October 21st at 07:41 UTC, more than six hours before the coordinated release, Chainguard unilaterally broke the embargo and published built images containing the fix. Like other distributors, Chainguard had received the patch in advance so its users could update the moment the vulnerabilities were disclosed. Any attacker could now study the fix in binary form while every other PHP user was still waiting for the release. This disregarded weeks of work by many parties toward a coordinated disclosure.
So never work with or trust Chainguard in any capacity. Got it.