Embargo broken unilaterally, 6 hours ahead of schedule

Early release gave attackers a head start on reverse-engineering

Proof-of-concept video briefly exposed before deletion

2024 external audit had already flagged signs of the flaw

A patch for a security flaw in the PHP programming language was released Wednesday (local time), but criticism has emerged after some vendors published the code ahead of the agreed embargo, giving hackers an early window to analyze it. [123RF]
A patch for a security flaw in the PHP programming language was released Wednesday (local time), but criticism has emerged after some vendors published the code ahead of the agreed embargo, giving hackers an early window to analyze it. [123RF]

A controversy has erupted after some vendors released code for a security patch in PHP — the programming language used by more than 75 percent of websites worldwide — ahead of the agreed embargo, potentially giving hackers a window to analyze the fix before users could apply it.

The PHP Foundation said Wednesday (local time) that Chainguard, a patch distribution vendor, published patched images more than six hours before the scheduled release. In an official statement, the foundation said Chainguard "unilaterally broke the embargo" and called the move a disregard for "weeks of effort by numerous parties to coordinate a responsible disclosure."

When a patch is released ahead of schedule, attackers can reverse-engineer the code to develop exploit tools. Meanwhile, users are left waiting for the official update — effectively handing hackers a six-hour head start. Even after the official update is released, systems could remain vulnerable to attacks built from that early analysis.

"All attackers were able to study the patch in advance, while users still had to wait for the official release," the foundation said, sharply criticizing Chainguard. The foundation did not separately address whether any actual harm had resulted from the incident.

The foundation also said that a separate mistake by another security firm accelerated attackers' ability to develop exploit tools. Kalif, a security company, accidentally posted a video demonstrating how to exploit the vulnerability before deleting it — effectively showing hackers how to attack the original program. Observers said the back-to-back missteps could prove particularly damaging given that advances in AI tools have dramatically accelerated the speed at which patch code can be reverse-engineered and weaponized.

Ty Duong, the CEO of Kalif and the person who first discovered the vulnerability, warned that "someone could take the patch, run it through AI, and post a script to exploit it," adding, "That would cause complete chaos."

Chainguard did not address the early release directly. Instead, the company posted on X, formerly Twitter, saying it was "grateful for everyone's help over the past few days in working through this" and acknowledging that "coordinated disclosure of vulnerabilities is hard."

Meanwhile, it emerged that PHP's development team had detected signs of some flaws during an external security audit in 2024 but failed to proceed with patch development due to difficulties reaching internal consensus and concerns about compatibility with existing programs. The PHP Foundation acknowledged the delay, saying, "We will not hide the facts," and describing it as "a structural failure stemming from both the decision-making process of the security team and a lack of resources."


kate01@heraldcorp.com