r/programming • u/elizabethn • 6d ago

Today's PHP Security Release, and How We're Strengthening PHP Security

https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/
85 Upvotes

92% Upvoted

5 comments sorted by

105

u/cosmic-parsley 6d ago

One important takeaway of the response:

On October 21st at 07:41 UTC, more than six hours before the coordinated release, Chainguard unilaterally broke the embargo and published built images containing the fix.

If you are working with Chainguard, this is an indicator that they cannot be trusted and you should immediately drop them from security coordination. Happily throwing the entire world under the bus for a PR boost is a HUGE no-no.

More at https://www.reddit.com/r/cybersecurity/comments/1xbsyc2/todays_php_security_release_and_how_were/

21

u/[deleted] 5d ago edited 4d ago

18

u/cosmic-parsley 5d ago

Even if that was happening, the correct action is to communicate and get everyone to move the time up. Doing it unilaterally just screws everybody else over more.

Literally I turn now, good luck everybody else! mentality.

24

u/BaaaSaracilor 6d ago

Lack of funding seems to be a pretty big issue here too.

The post specifically mentions that they just don't have the manpower to handle all of this stuff.

-23

u/this_knee 6d ago

I stopped using php more than 15 years ago, due to security risks. Surprised it’s still in such high use today.