That sounds oddly threatening, especially given that chainguard is in the right here. Embargoes are stupid in 2026 and make no sense. The rumor of this issue was enough for it to be independently discovered by several white hats and almost certainly many threat actors.
> Embargoes are stupid in 2026 and make no sense. The rumor of this issue was enough for it to be independently discovered by several white hats and almost certainly many threat actors.
The point of the embargo was to prevent all rumors? But it did not hold.
Releasing a statement that a critical security bug exists with no more information, does the opposite of preventing rumors. I think one of the most surefire ways of generating rumors is to say "something big will happen tomorrow, please don't speculate about it".
Anyway, GPs point is that even if nobody leaked anything, and the only thing publicly known was the existence of the bugs, people would anyway have been able to find them independently. So what is the purpose of waiting 24h before releasing the patches?
That’s also a take based on nothing.
I can say with high confidence that Nginx, Apache and IIS have a critical security vulnerability hidden somewhere in their codebase right now.
Please provide the prompt that uncovers it. Apparently knowing about the existence of bugs is enough nowadays right?
I’ll wait.
Yeah I don’t really get this, the rumor “there is some exploitable vulnerability in php” can’t really be the problem, because that’s probably known to everyone already. The rumor only helps you exploit it if there’s some specific hint how the exploit works.
This is BS, lol, “embargoes are stupid in 2026”, no they are not, they are more needed than ever and should be respected.
Chainguard was definitely not in the right here.