A lot of people in techny internet spaces online are talking about a PHP embargo. What does that mean and what's going on?

you are viewing a single comment's thread
view the rest of the comments
[–] 16 points 2 weeks ago* (last edited 2 weeks ago) (1 child)

Just to add: there was an embargo on releasing the patch and information about the patch, but some website or something broke the embargo.

That meant that malicious people could read what the patch was doing and understand how to exploit the issue/bug.

Edit: all the details are here: https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/

  • source
  • hideshow 1 child comment
  • [–] 13 points 2 weeks ago

    Chainguard claims they had evidence of exploits being used in the wild. If that’s true breaking the embargo was the correct move. The embargo is only useful if the exploit isn’t in the wild.

  • source
  • parent