SecurityFan score 20 · Tier C
Chainguard defends its choice to break the PHP security embargo: “We own the decision.”
The New Stack · By Steven J. Vaughan-Nichols ·
The Brief
- Chainguard released patched PHP container images before an embargo agreed with other partners had lifted.
- At KubeCon + CloudNativeCon North America 2026, CTO Matt Moore defended the decision and said "We own the decision."
Why it matters
Developers using Chainguard's PHP images may receive security fixes earlier, but the release broke a coordinated embargo that other partners had agreed to, which affects how far the fix can be trusted to be coordinated.
Who’s affected
- Teams using Chainguard PHP container images
- PHP users who depend on coordinated security embargoes
- #php
- #chainguard
- #security
- #embargo
- #containers
At KubeCon + CloudNativeCon North America 2026 this week , Chainguard co-founder and CTO Matt Moore defended the company’s decision to release patched PHP images before an agreed-upon embargo with other partners had lifted. When Chainguard shipped patched PHP container images…
Timeline
Matt Moore defends Chainguard's release of patched PHP images before the embargo lifted, at KubeCon + CloudNativeCon North America 2026
The New Stack
Chainguard defends its choice to break the PHP security embargo: “We own the decision.”