Gatekeepers Fume as Vendor Breaks Their Secret Club Rules

Chainguard shipped patches for the PHP bugs more than six hours ahead of the planned, coordinated release, according to the PHP Foundation. For that, a top official at the Cybersecurity and Infrastructure Security Agency called the move "dangerous" and "inappropriate." Welcome to the world of coordinated disclosure, where who gets told about a hole in the software running the web, and when, is settled in advance by a closed circle of insiders.

Who Has the Power

Here's how the arrangement works. Under coordinated disclosure, security firms like Chainguard receive vulnerability information in advance so they can develop patches and their users can update the moment the news goes public. Everyone else waits. The agreed date this time was Oct. 21, 2026. Chainguard moved first, and the PHP Foundation wrote that "any attacker could now study the fix in binary form while every other PHP user was still waiting for the release." It added that this "disregarded weeks of work by many parties toward a coordinated disclosure."

The state weighed in three days ago, on Oct. 28. Jay Gazlay, CISA's acting associate director for vulnerability management, told a conference hosted by Red Hat in Washington, DC: "I will say that that type of behavior is dangerous, and we've got to be careful about holding embargoes." He went on: "We've got to be careful about holding the trust groups because the minute we stop behaving in in a manner that is honorable and trusting in this world, it gets ridiculous."

Honorable. Trusting. Trust groups. It's the language of a private fraternity, not of a public safety system. And Gazlay wants enforcement by peer pressure: "Anytime somebody behaves in a way that is inappropriate, if we're like, 'Oh yeah, it's fine,' they're going to do it again." CISA declined to make him available for a follow-up interview.

What They're Calling "Order"

Chainguard CEO Dan Lorenc defended the decision in a LinkedIn post, citing how easily his team "independently discover[ed] the vulnerability and build an exploit," plus "the evidence shared on active exploits in the wild." The PHP Foundation says it "did not identify any functional exploits at the time of release/public disclosure." Some research found attempted exploits dating back to Oct. 17. Confirmation of a working exploit took several days after official disclosure. CISA added the bug to its Known Exploited Vulnerabilities catalog on Oct. 26.

Lorenc called judgment-based decisions like this one "messy." He said the pace set by frontier AI labs is adding "a lot of friction and pressure" across software supply chains. "What happens when you're sitting on one and can't get it up-streamed in time, and then harm happens during that period," he asked, adding that others are "sitting on these vulnerabilities" right now. Joe Slowik of Dataminr said he has seen no public evidence backing Chainguard's call. He also said he disagrees with freezing the company out of future talks.

The PHP Foundation's executive director, Elizabeth Barron, told Politico the foundation was "disappointed" but hopes to "rebuild trust."

Who Gets Crushed

The people who pay when this machinery stumbles aren't in the room. They're the users of every PHP-powered site, left waiting while a handful of vendors, a nonprofit foundation and a federal agency negotiate timing among themselves. Nobody downstream was asked. The same cohort that keeps the secret decides when the secret ends.

And the slop is piling up. Security researchers reported many AI-hallucinated exploits tied to the PHP bugs on GitHub. Gazlay said CISA's own team spent multiple days with "some of the best analysts in the world" and "great models" to build a working proof of concept. The evidence that came in afterward, he said, "was terrible. It was just slop."

Ramy Rahman of ArmorCode said vendors should want "to enable our customers to be able to make their decisions on their own, so that we have more open information." That's a striking admission from inside the trade: the people running this scheme concede that the customers' own decisions get squeezed out. A vendor that calls for better trust among itself and its peers, while the rest of us wait on an embargo clock, is describing a club, not a commons. Lorenc himself said the industry has to "get crisper" and "do a better job on next time." Next time, the same circle will decide again.