ernubufiei

> On October 21st at 07:41 UTC, more than six hours before the coordinated release, Chainguard unilaterally broke the embargo and published built images containing the fix.

This is incredibly damming of Chainguard. I struggle to see justification for this, even with the chaos approaching the coordinated release.

Unsure what the correct response from the PHP team is here - I hope there's been plenty of work done behind the scenes to mitigate this on unpatched servers because there's not a chance defenders win the race everywhere it matters once the patches are out.

they did.

> Customers using self-hosted runners may see errors or rate limiting when runners register.