Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?

Source · news · secondary · captured

PHP blames supply chain security biz Chainguard for putting huge chunks of the web at risk

The Register · https://www.theregister.com/security/2026/10/22/php-blames-supply-chain-security-biz-chainguard-for-putting-huge-chunks-of-the-web-at-risk/5304611 · published 2026-10-22 · added by claude-story-site · slug theregister-php-blames-chainguard

Carries Dan Lorenc's reply: 'I made the call to get these out early when exploits hit in the wild'; several unnamed vendors; honeypots trapped IPs from China and Russia; a researcher warned on the Friday; found independently with an AI harness; apology for the stress.

What it says, as the collector read it

PHP blames supply chain security biz Chainguard for putting huge chunks of the web at risk

Captured by claude-story-site. Status: captured. Carries Dan Lorenc's reply: 'I made the call to get these out early when exploits hit in the wild'; several unnamed vendors; honeypots trapped IPs from China and Russia; a researcher warned on the Friday; found independently with an AI harness; apology for the stress.

Secondary but the fullest account of Chainguard's side. Lorenc did not name vendors or publish evidence.

Claims that cite it

Claim	Who says it	Status	Fact-check	Primary	Sources
Chainguard unilaterally broke the embargo on 21 October at 07:41 UTC by publishing built images containing the fix Dan Lorenc (via The Register): 'I made the call to get these out early when exploits hit in the wild'; several unnamed vendors had reported exploits; Chainguard's honeypots trapped IPs; a researcher warned the company on the Friday and its team then found the bugs independently with an AI harness. No evidence published. The PHP security team found no functional exploit by release time. fact timeline →	PHP Foundation; Chainguard's CEO accepts the time and denies leaking	disputed	A2 Reported opinion disputed	1/3	PHP Foundation The Register Feross Aboukhadijeh on X on X
Chainguard's team found the same bugs independently with an AI harness and a frontier model after a researcher warned them on the Friday before Unverified by anyone else. fact timeline →	Dan Lorenc, via The Register	reported	A2 Reported	0/1	The Register

Events that cite it

When	Event	Time is
2026-10-22	The Register carries Dan Lorenc's reply to the PHP Foundation; Fortinet publishes FortiWeb signatures; The Record carries the Foundation's account of the 2024 signs.	stated

Exploitation signals from this source

2026-10-22: Chainguard's honeypots trapped IPs from China and Russia; several unnamed vendors reported exploits in the wild.

The bytes

capture 20261022T113204Z · HTTP 200 · https://www.theregister.com/security/2026/10/22/php-blames-supply-chain-security-biz-chainguard-for-putting-huge-chunks-of-the-web-at-risk/5304611

headers.json f037ca6b2e792623b19de3cc87220576a70faf147d1140a31fe0f0a22fa34d1e 610 bytes
page.html f7f24a70afadc30edf03beb3e697086d5126ad7f5ddf2875c2e5c54bc07208a5 183,584 bytes
provenance.json 28bb52465a44cfdc683cafd60ae043da8145a2e31fa1e280fa7ed7b81e417e32 1,225 bytes
rendered.html 3729f08f3b948bc4af5a39a2b7351e38db6eeafbbcb982556755e5929dabb56d 197,763 bytes
screenshot.png d7c98b6141ded745143bbb5bc018fb02e07f795ab320a20434e063f150a3b875 1,745,666 bytes
text.txt b355691c9b584c533c626787860d8f2f329c17e1618422ab1088cfcdb71530ca 13,215 bytes

capture 20261023T160435Z · HTTP 200 · https://www.theregister.com/security/2026/10/22/php-blames-supply-chain-security-biz-chainguard-for-putting-huge-chunks-of-the-web-at-risk/5304611

headers.json a1978393d061c66f63509e1c1c1a981a94391c640732adda0650aff46e5136d2 681 bytes
page.html 2ae362bc7596728abff7d47881889ac36ea6b0f56b399d1764f98a7032de6dec 183,254 bytes
provenance.json 84d6fb599d488aaf94357843ef4ed03d95f6b1c458afccacf0ceb42f0e84a701 1,985 bytes
rendered.html b138f7fef816c5180a11c1d2fc70655a5669b0af56c0c9eb19c663c72191ca2c 199,783 bytes
screenshot.jpg 1451218d7d84aec414a1764685d312ecefea6858a4a230fda6c9991961e4f3cc 964,556 bytes
text.txt ca382cdb9b4ecdf3e8ef86975c0671cea61b842d9de3ca1b06b1f60c98febe6d 12,962 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. Every source →