Security incident · checklist estimated
Chainguard defends releasing patched PHP images during embargo
Tier C · Keep an eye on it – Check if you’re affected
Tier C because: Hits tech teams
Reach
Attack
Damage
Fix
The Brief
- Chainguard released patched PHP container images before an embargo agreed with other partners had lifted.
- At KubeCon + CloudNativeCon North America 2026, CTO Matt Moore defended the decision and said "We own the decision."
Why it matters
Developers using Chainguard's PHP images may receive security fixes earlier, but the release broke a coordinated embargo that other partners had agreed to, which affects how far the fix can be trusted to be coordinated.
The checklist behind the tier
Checklist · 1 of 10 yes · estimated from older data, not yet checked against the sources
| Yes | Hits tech teams | Does it affect software, devices or services that developers, ops or IT teams build with, run or are responsible for? |
| No | Core infrastructure | Is the flaw in, or the compromise of, software that nearly every team runs? |
| No | Popular tool | Is the flaw in, or the compromise of, a widely used framework, tool, platform, OS or package? |
| No | Exploited in the wild | Do sources report real attacks using it? |
| No | Public exploit | Is a working exploit or detailed proof-of-concept public? |
| No | Remote, no login | Can an attacker use it over the network without credentials or user interaction? |
| No | Full takeover | Does it lead to code execution, root/admin rights or full account takeover? |
| No | Secrets exposed | Were credentials, tokens, keys, configs, source code or customer data stolen or exposed? |
| No | Supply chain | Was malicious code shipped through a channel developers trust? |
| No | No fix yet | Is there no patched version yet? |
Timeline
Matt Moore defends Chainguard's release of patched PHP images before the embargo lifted, at KubeCon + CloudNativeCon North America 2026
The New Stack
Chainguard defends its choice to break the PHP security embargo: “We own the decision.”
Source
Chainguard defends its choice to break the PHP security embargo: “We own the decision.” ↗ The New Stack · 44 min ago
First seen · 1 source · Full story page · How tiers are decided