So, it's been 26 hours from me learning about the vulnerabilities to this.
"Assume breach" gets less and less preparatory.
Layer 8½
@mbrookspetersen.eurosky.social
94 followers 144 following 560 posts
Cybersecurity Awareness & Culture Specialist. Posting about general #infosec and people stuff. Blog: layer8-half.leaflet.pub Opinions are my own. Profile pic by rpg.actor
![On Tuesday, October 20th, at around 15:00 UTC, the two CVE IDs began circulating on online forums and social media. They came with a wrong release time and a wrong CVSS score of 10.0 (the actual score is 9.2). No technical details leaked. In response, the PHP project brought its pre-announcement forward and published it at 19:30 UTC. It also moved the release from October 22nd, 14:00 UTC, to October 21st, 14:00 UTC. Distributors were still packaging the fix, so releasing immediately would have left many users without an easy way to update. Moving the release forward by one day was the best compromise between acting quickly, giving people time to prepare, and making sure everyone had a simple update path when the vulnerabilities were disclosed.
As a result of the leak and pre-announcement around 20:00 UTC, Calif, one of the security firms that had reported the issues mistakenly published a video. [..] The video contributed to accelerated development of various PoCs (exploitation proof of concepts), which then increased circulation on October 21st.
Mitigation advice we started providing to a few critical infrastructure providers around Oct 20th 23:00 UTC, may have leaked as well. The PHP security team closely monitored and inspected appearing PoCs after the leak but did not identify any functional exploits at the time of release/public disclosure.
On October 21st at 07:41 UTC, more than six hours before the coordinated release, Chainguard unilaterally broke the embargo and published built images containing the fix. Like other distributors, Chainguard had received the patch in advance so its users could update the moment the vulnerabilities were disclosed. Any attacker could now study the fix in binary form while every other PHP user was still waiting for the release. This disregarded weeks of work by many parties toward a coordinated disclosure.](https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:xjkqe2uyxc2tpimt3b2vyqhg/bafkreig7agesjcqjb52obrzfzud6zpyhs4ogzfcnk7mkygtmzkk66gghue)
