alt Hacker NewsNah, Chainguard should be praised for this. It was a different company that leaked the POC early, and then PHP, Wiz, OpenAI, and Calif sat on their hands doing nothing while the vuln was being actively exploited in the wild. Chainguard did the right thing by getting the fix out as quick as possible to stop the bleeding (or gushing flow of blood, really) rather than sitting on it so they could make a coordinated marketing post, like the others did.
Replies
>... Wiz, OpenAI, and Calif sat on their hands doing nothing while the vuln was being actively exploited in the wild.
What was Wiz/OpenAI supposed to do? PHP was already aware of the issue.
But did they "get the fix out"?
They released some binaries, built for their own docker image based on their own Linux distro. Other people couldn't use Chainguard's "fix" to patch their own systems. The only people who seem to have benefited from the stunt are the hackers who used AI to reverse-engineer the binaries and write exploits.
That was a giant fuck-you to the rest of the PHP ecosystem, nothing more.
> It was a different company that leaked the POC early,
[citation needed]
By which i mean, this seems untrue. If you mean the anime video, that is not a leak of a PoC.
That's a reasonably take. Embargos only work until the information's leaked, and once that's happened, however it happened, the bad guys have the exploit information and the clock starts ticking.