Your supply-chain security vendor is selling you somebody to blame

When the PHP Foundation published its account of the PHP2shell disclosure this week, it singled out one company for breaking the embargo. Chainguard, it said, pushed built images containing the fix at 07:41 UTC on 21 October, more than six hours before the coordinated 14:00 release, so attackers could diff the binaries while everyone else waited.

I expected to take the maintainers' side. Then I read the timeline. The two CVE IDs were already circulating at about 15:00 UTC the day before, along with a wrong release time and a wrong CVSS score of 10.0 (the real one is 9.2). Around 20:00 UTC, Calif, one of the firms that reported the bugs, published a video of its proof of concept running against real targets, which the Foundation describes as a mistake and says sped up the public exploit code that followed. The Foundation also concedes that mitigation advice it gave a few critical infrastructure providers may have leaked. According to Socket and The Next Web, it first spotted signs of one of the flaws in 2024 and then spent months unable to agree on a fix. Of all the parties who let information out early, Chainguard is the one with a sales team and a CEO who talks to reporters, so Chainguard got the headline.

If you buy from Chainguard or any of its competitors, the blame game is a sideshow. The interesting question is what your money bought during those two days. Chainguard sells hardened open-source images. It did not write PHP. When an unauthenticated remote code execution bug turned up in every PHP release back to 5.4, on a language W3Techs says runs 69.3% of sites whose server-side language it can identify, the vendor's images were as exposed as everyone else's until a patch existed. What customers actually received was early patched builds, and Chainguard then made its PHP 8.2, 8.3, 8.4 and 8.5 images free for anyone. Paying customers got a few hours' head start over the public and a vendor now fighting a public row on their behalf.

The row turns on a judgement call. Lorenc told The Register and Recorded Future News that he saw exploitation attempts the night before and decided to ship, and that Chainguard's honeypots caught IPs from China and Russia going after the bugs on Wednesday. The PHP security team says it watched the proof-of-concept code and found no functional exploits at the time of release. One of them is reading the evidence badly. Whoever it is, a single executive decided how much risk thousands of customers would carry that night, and I doubt a single customer contract says a word about when the vendor may break an embargo or whether the customer hears first.

Lorenc also undercut the scanning half of his own industry's pitch. He says he independently found the same memory corruption bugs on the Friday using a frontier model and a prompt as basic as "find bad vulnerabilities in PHP". If bug-hunting is that cheap, then what a supply-chain vendor really sells is speed to a patched build and judgement under pressure. Both can be measured, and in most contracts I have seen, neither carries a penalty.

Vendors will say they cannot be liable for upstream code written by volunteers, and that liability would either triple their prices or make them slower and more cautious, which hurts customers in exactly the week that counts. I think that gets the economics backwards. These companies already charge a premium on the claim that their images lower your risk. Asking them to attach a service credit to a time-to-patch commitment only asks them to price the claim they are already selling. If the hardening is as good as the deck says, the credits will rarely pay out and the vendor loses little. If a vendor refuses any money-backed commitment, you have learned how much it believes its own marketing, and you should negotiate the licence fee accordingly.

The same goes for the embargo decision. Chainguard's policy, as Lorenc described it, is to coordinate until exploitation starts and then ship. That may be the right policy. It should still be a written term, with a named person who makes the call and a promise to notify customers before the images go out, because the PHP Foundation will now be wondering whether to hand its next patch to distributors at all, and if it stops, your vendor's early access disappears with it.

Pull your supply-chain security contract this week and search it for "embargo" and "service credit". If neither word appears, put both on the agenda for your next renewal, and if the vendor will not sign, ask for a discount equal to what your team spent patching PHP since Tuesday.

Prompted by PHP blames supply chain security biz Chainguard for putting huge chunks of the web at risk, theregister.