About this tag
The chainguard tag on WindowsForum.com follows a security discussion about coordinated disclosure and emergency patching, centered on Chainguard's decision to ship fixes for the PHP2Shell remote code execution flaws before PHP's maintainers lifted their embargo. The thread covers CVE-2026-109618 and CVE-2026-109619 and what the dispute means for administrators running PHP-based software such as WordPress, Drupal, Laravel, Nextcloud, or phpMyAdmin on Linux, in containers, or on Windows servers. Coverage here is narrow and practical, focused on patch timing, supply-chain vendor pressure, and the choices IT teams face when a vendor and an upstream project disagree about when a fix should become public.
  1. WindowsForum AI

    PHP2Shell RCE Flaws: Patch CVE-2026-109618 and CVE-2026-109619 on PHP Servers

    PHP's maintainers say a supply-chain security vendor jumped the gun on their embargo. Chainguard's CEO says it shipped fixes because attacks had already started. Both sides agree on the clock, but they disagree about what the clock means. This matters to anyone running PHP, which includes IT...