# Source: PHP blames supply chain security biz Chainguard for putting huge chunks of the web at risk

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

The Register: what it says, the claims and events that cite it, and the hashes of every captured file.

Source · news · secondary · captured

# PHP blames supply chain security biz Chainguard for putting huge chunks of the web at risk

**The Register** · [https://www.theregister.com/security/2026/10/22/php-blames-supply-chain-security-biz-chainguard-for-putting-huge-chunks-of-the-web-at-risk/5304611](https://www.theregister.com/security/2026/10/22/php-blames-supply-chain-security-biz-chainguard-for-putting-huge-chunks-of-the-web-at-risk/5304611) · published 2026-10-22 · added by `claude-story-site` · slug `theregister-php-blames-chainguard`

Carries Dan Lorenc's reply: 'I made the call to get these out early when exploits hit in the wild'; several unnamed vendors; honeypots trapped IPs from China and Russia; a researcher warned on the Friday; found independently with an AI harness; apology for the stress.

## What it says, as the collector read it

#### PHP blames supply chain security biz Chainguard for putting huge chunks of the web at risk

Captured by claude-story-site. Status: captured. Carries Dan Lorenc's reply: 'I made the call to get these out early when exploits hit in the wild'; several unnamed vendors; honeypots trapped IPs from China and Russia; a researcher warned on the Friday; found independently with an AI harness; apology for the stress.

- Secondary but the fullest account of Chainguard's side. Lorenc did not name vendors or publish evidence.

## Claims that cite it

| Claim | Who says it | Status | [Fact-check](https://php.oct.2026.newsroom.sgit.ai/factcheck/) | Primary | Sources |
|---|---|---|---|---|---|
| Chainguard unilaterally broke the embargo on 21 October at 07:41 UTC by publishing built images containing the fixDan Lorenc (via The Register): 'I made the call to get these out early when exploits hit in the wild'; several unnamed vendors had reported exploits; Chainguard's honeypots trapped IPs; a researcher warned the company on the Friday and its team then found the bugs independently with an AI harness. No evidence published. The PHP security team found no functional exploit by release time. [fact timeline →](../../facts/chainguard/index.html) | PHP Foundation; Chainguard's CEO accepts the time and denies leaking | disputed | **A2** Reported●●○○○○ opinion disputed | 1/3 | [PHP Foundation](../../sources/php-foundation-blog-security-release/index.html) [The Register](../../sources/theregister-php-blames-chainguard/index.html) [Feross Aboukhadijeh on X on X](../../sources/x-feross-chainguard/index.html) |
| Chainguard's team found the same bugs independently with an AI harness and a frontier model after a researcher warned them on the Friday beforeUnverified by anyone else. [fact timeline →](../../facts/lorenc-ai-found/index.html) | Dan Lorenc, via The Register | reported | **A2** Reported●●○○○○ | 0/1 | [The Register](../../sources/theregister-php-blames-chainguard/index.html) |

## Events that cite it

| When | Event | Time is |
|---|---|---|
| 2026-10-22 | The Register carries Dan Lorenc's reply to the PHP Foundation; Fortinet publishes FortiWeb signatures; The Record carries the Foundation's account of the 2024 signs. | stated |

### Exploitation signals from this source
- [2026-10-22](https://php.oct.2026.newsroom.sgit.ai/exploitation/): Chainguard's honeypots trapped IPs from China and Russia; several unnamed vendors reported exploits in the wild.

## The bytes
capture 20261022T113204Z · HTTP 200 · https://www.theregister.com/security/2026/10/22/php-blames-supply-chain-security-biz-chainguard-for-putting-huge-chunks-of-the-web-at-risk/5304611- `headers.json` f037ca6b2e792623b19de3cc87220576a70faf147d1140a31fe0f0a22fa34d1e 610 bytes
- `page.html` f7f24a70afadc30edf03beb3e697086d5126ad7f5ddf2875c2e5c54bc07208a5 183,584 bytes
- `provenance.json` 28bb52465a44cfdc683cafd60ae043da8145a2e31fa1e280fa7ed7b81e417e32 1,225 bytes
- `rendered.html` 3729f08f3b948bc4af5a39a2b7351e38db6eeafbbcb982556755e5929dabb56d 197,763 bytes
- `screenshot.png` d7c98b6141ded745143bbb5bc018fb02e07f795ab320a20434e063f150a3b875 1,745,666 bytes
- `text.txt` b355691c9b584c533c626787860d8f2f329c17e1618422ab1088cfcdb71530ca 13,215 bytes
capture 20261023T160435Z · HTTP 200 · https://www.theregister.com/security/2026/10/22/php-blames-supply-chain-security-biz-chainguard-for-putting-huge-chunks-of-the-web-at-risk/5304611- `headers.json` a1978393d061c66f63509e1c1c1a981a94391c640732adda0650aff46e5136d2 681 bytes
- `page.html` 2ae362bc7596728abff7d47881889ac36ea6b0f56b399d1764f98a7032de6dec 183,254 bytes
- `provenance.json` 84d6fb599d488aaf94357843ef4ed03d95f6b1c458afccacf0ceb42f0e84a701 1,985 bytes
- `rendered.html` b138f7fef816c5180a11c1d2fc70655a5669b0af56c0c9eb19c663c72191ca2c 199,783 bytes
- `screenshot.jpg` 1451218d7d84aec414a1764685d312ecefea6858a4a230fda6c9991961e4f3cc 964,556 bytes
- `text.txt` ca382cdb9b4ecdf3e8ef86975c0671cea61b842d9de3ca1b06b1f60c98febe6d 12,962 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. [Every source →](../index.html)


---
site v0.22.26 · data as of 2026-10-25T14:40Z · vault commit 94352a55fbaa · https://refs.php.oct.2026.newsroom.sgit.ai/sources/theregister-php-blames-chainguard/index.html