There is apparently some blame going around for PHP’s messy disclosure. The Register has some details which paint a very different picture from PHP Foundation’s own blog post. If the vulnerabilities were in fact already being exploited, then Chainguard not waiting for the agreed upon release time makes perfect sense. The question is rather: why didn’t everybody else make the same call? Why didn’t PHP Foundation drop the embargo? Were they aware of the ongoing attacks?
There is another layer to this of course. Somebody leaked hints to this a few days too early. Which is unfortunately to be expected for an effort that takes months and involves so many parties. If anything, this disclosure went unexpectedly smoothly. And it still doesn’t change the fact that there will be vulnerable PHP installations for years to come.
To me this only shows: coordinated disclosure on this scale isn’t a silver bullet. It mitigates risks to some degree but we now have a world where the attackers can generate exploits faster than server administrators can reasonably be expected to install updates – and sometimes even before these updates are out because somebody got wind that the vulnerability might be there. I don’t think that we have the right tools to deal with that changed threat landscape just yet.