PHP blames supply chain security biz Chainguard for putting huge chunks of the web at risk — Live Feedhttps://www.live-feeds.com/feed/php-blames-supply-chain-security-biz-chainguard-for-putting-huge-chunks-of-the-web-at-riskContinuously updated, source-cited coverage. PHP Blames Chainguard for Early Disclosure of PHP2Shell Bugshttps://www.live-feeds.com/feed/php-blames-supply-chain-security-biz-chainguard-for-putting-huge-chunks-of-the-web-at-riskhttps://www.live-feeds.com/feed/php-blames-supply-chain-security-biz-chainguard-for-putting-huge-chunks-of-the-web-at-risk#u153882Sun, 25 Oct 2026 11:45:15 +0000PHP maintainers have accused software supply chain security firm Chainguard of irresponsibly disclosing critical bugs ahead of an official coordinated release. The PHP2Shell vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, affect a vast portion of the internet and prompted emergency patches from PHP developers. Cloudflare has deployed protections against the flaw, and the NSA has recommended critical patches. Meanwhile, Chainguard's CEO defended the early disclosure by citing a lack of active exploits at the time.Why it mattersThe disclosure dispute centers on two critical