Chainguard

You've got IBM and Red Hat throwing $5 billion to helping to solve the problem.

And Chainguard with the Athena Coalition going out there and being like, right, we'll be a clearinghouse.

And the Linux Foundation standing up an emergency project, another clearinghouse called Acritis, to help coordinate a more sustainable response to all of this.

And it's like, we've got this tsunami of vulnerabilities coming at us.

What chain guard does is they put out pre hardened builds and images of packages so that their customers are pulling from not the public repo of stuff.

When you like include a package in your code, you pull the chain guard one, or if you include a Docker image, you pull from the chain guard, Docker image repo, right? And they're, they're, they're pre hardened and all this kind of stuff, right? So the CEO of Chainguard, and I have his LinkedIn post up right here kind of explaining his thought process, and we can kind of cut this on the screen, is that he got word about this bug.

They started to try to reproduce it The way that he said that he was able to reproduce it is the frightening part here, right? There's some clamoring about how accurate this is.

There's a lot of drama and ripple effects having to do with this LinkedIn post that we can get into.

Where do you land on this?

I don't know how to feel about this.

I think it's easy to be like, oh, Dan broke a rule, so Dan bad, like Chainguard bad.

But at the same time, I agree with your point.

So there's a... a cautionary tale in here about a particular company that really messed it up, like really, really messed it up.

So Chainguard is a hardened image company that makes basically like, you know, very secure hardened images of Linux and different things that they then sell to their customers and their customers use as something that is safe.

They were brought into the circle of trust about PHP, and they were told there's an embargo, nobody talks about this, nobody says anything about it until this particular date and time, which was supposed to be Wednesday morning, and nobody has permission to release anything until then.

Chaingard's CEO unilaterally decided, without conversing with anybody else, without checking with the PHP Foundation that actually maintains PHP, decided that they had enough information to go ahead and release their hardened image with a fix to that PHP issue.

What does that mean two years ago? Nothing.

Like two years ago, who cares? Because it's going to take somebody three or four months to reverse engineer that fix and then get to an attack path or get to a kill chain using the information that they gleaned from that patch.

But now that these open weight models are in the wild, it was 90 minutes between the time that Chainguard released their patch and they started seeing indicators of compromise in the wild because someone had reverse engineered that patch and then was exploiting PHP in

90 minutes.

No, and here's the line that made me sit up.

Dan Lorenz, the CEO of Chainguard, said his company independently found the same bugs by typing, and I mean this literally, find bad vulnerabilities in PHP into a frontier AI model.

That's insane, actually.

That's the whole exploit discovery pipeline collapsed into a sentence you'd type into a chat box.

On October 21st, 741 UTC, more than six hours before the coordinated release, remember that the coordinated release was at 1400.

So at 741 UTC, Chainguard unilaterally broke the embargo and published built images containing the fix.

Like other distributors, Chainguard had received the patch in advance so its users could update the moment the vulnerabilities were disclosed.

Any attacker could now study the fix in binary form with every other PHP user while every other PHP user was still waiting for the release.

This disregarded weeks of work by many parties toward a coordinated disclosure.

It messes it up for everyone.

It's incredibly selfish.

It's not difficult to imagine that Chainguard will not be offered early access to future critical release information, certainly not by the PHP Foundation, who are clearly annoyed by that big time.

On October 21st, 741 UTC, more than six hours before the coordinated release, remember that the coordinated release was at 1400.

So at 741 UTC, Chainguard unilaterally broke the embargo and published built images containing the fix.

Like other distributors, Chainguard had received the patch in advance so its users could update the moment the vulnerabilities were disclosed.

Any attacker could now study the fix in binary form with every other PHP user while every other PHP user was still waiting for the release.

This disregarded weeks of work by many parties toward a coordinated disclosure.

It messes it up for everyone.

It's incredibly selfish.

It's not difficult to imagine that Chainguard will not be offered early access to future critical release information, certainly not by the PHP Foundation, who are clearly annoyed by that big time.