Why this site exists

The CVE Program keeps a public list of who is allowed to assign CVE identifiers. Those organizations are CNAs: CVE Numbering Authorities. Chainguard is on the list. This page checks the list every hour and tells you whether that is still true.

It exists because of what happened to the PHP 8.5.12 release on 21 October 2026.

What this site does

Once an hour, a small Go program downloads the CNA registry, looks for the record with the short name chainguard, and rewrites the front page with the answer and the time of the check. If the download fails, the page says it failed instead of guessing. Nothing runs in your browser. The whole site is a few kilobytes of HTML and CSS.

The short version of 21 October

PHP shipped emergency releases — 8.5.12, 8.4.27, 8.3.36 and 8.2.35 — for two critical memory bugs. CVE-2026-109618 let a request that hit PHP's memory limit at the wrong moment leave half-built internal data behind, which PHP then trusted. CVE-2026-109619 let a fatal error leave state pointing at memory from an earlier request, which the next request could reuse. On Apache with mod_php, the first one needed no application code at all. Both are rated 9.2.

The release was coordinated across a lot of people. Distributors, hosting companies and long-term support vendors got the patch early, so their users could update the moment the details went public. That is the deal an embargo makes: everyone holds the patch, nobody ships it, and the fix lands everywhere at once.

The deal started to come apart a day early. On 20 October, at about 15:00 UTC, the two CVE identifiers began circulating with the wrong release time and a wrong score of 10.0. No technical details came with them. PHP moved its pre-announcement forward to 19:30 UTC and pulled the release from 22 October to 21 October at 14:00 UTC. One of the reporting firms, Calif, published a proof-of-concept video by mistake around 20:00 UTC, and copies spread.

Then, at 07:41 UTC on 21 October, more than six hours before the coordinated release, Chainguard published built images containing the fix. Any attacker could now compare the patched binaries against the unpatched ones while everybody else was still waiting for the announcement.

On October 21st at 07:41 UTC, more than six hours before the coordinated release, Chainguard unilaterally broke the embargo and published built images containing the fix. … Any attacker could now study the fix in binary form while every other PHP user was still waiting for the release.

— The PHP Foundation

Chainguard did not argue about the timing. Its own support article tells customers that "the image was updated hours before the disclosure" and calls that expected, because Chainguard "built the patched images overnight, before the public disclosure."

The defence, and the reply

Chainguard CEO Dan Lorenc gave his account on LinkedIn. He says one of the researchers tipped Chainguard off on 16 October. That night Chainguard found the same bug on its own with an AI model and a basic prompt. By Tuesday evening he says several vendors had reported seeing exploits in the wild. He decided to ship, and says he notified the group immediately. He also says the usual coordinated disclosure rules allow an early release once exploitation is confirmed.

Nils Adermann, a PHP Foundation board member who wrote the Foundation's statement, replied on that same post. He says there were no confirmed exploits: what the vendors reported was people probing. The Foundation says its security team found no working exploit at the time of release. He calls Chainguard's decision unilateral, taken without talking to the PHP team first.

What nobody disputes: the images went out more than six hours early, other distributors were still packaging, and no confirmed working exploit existed at release. The six hours Chainguard bought itself were paid for by the maintainers and distributors who had spent weeks keeping the schedule.

Why the CNA slot is the point

The Foundation did not blame the whole delay on anyone else. It says plainly that its own team's consensus process and thin staffing were a structural failure, and that fixing the 2024 bug took too long. That honesty is worth noting. The leak and the early images were a different kind of failure: someone outside the project deciding the schedule for it.

A CNA is trusted with more than a three-letter prefix. It reserves identifiers before the details are public, it hands them to researchers and vendors, and it is supposed to keep quiet and keep the schedule. The same registry entry that lets Chainguard assign CVE IDs is also the reason people extend that trust in the first place.

So the page asks a narrow question with a public answer. A company that decides, alone, that an embargo no longer applies is making a claim about how disclosure should work. The registry says whether the CVE Program still agrees that it should be one of the organizations assigning identifiers. That is all. One word, checked hourly.

Sources

• The PHP Foundation: Today's PHP Security Release, and How We're Strengthening PHP Security (21 Oct 2026)
• php.net release announcement (21 Oct 2026)
• Chainguard support: ACTION REQUIRED — Update Chainguard images with PHP
• PHP News: Chainguard Broke the php2shell Embargo (Lorenc's account; Adermann's reply)
• The Register: PHP blames supply chain security biz Chainguard (22 Oct 2026)
• Socket: PHP Foundation Says Chainguard Broke Security Embargo (21 Oct 2026)
• CVE Program: list of CNAs, and the machine-readable CNAsList.json this site reads

Corrections, clarifications and better citations are welcome: hrbrmstr@rud.is. This page is hand-written and static; the front page's answer is machine-generated once an hour. If the registry drops Chainguard, the front page flips on its own.