Comment by joshuat 15 hours ago fwiw it looks like the patches were made available early on chainguardhttps://images.chainguard.dev/directory/image/php/versions 5 comments joshuat Reply pxtail 15 hours ago How does it work that some service that most people never heard of distributes (paid) images with alleged fix for vuln 24h before official vuln fix/image is available? Seems somewhat shady. windowsworkstoo 15 hours ago thats chainguard’s entire value prop (they are quite well known in this sphere) jsploit 13 hours ago Good luck getting them to fix broken packages though. kassner 14 hours ago Is there a public announcement? I can only see PHP 8.5.11 images, but having a recent build date is not enough to say they are indeed patched. ibejoeb 12 hours ago context: https://news.ycombinator.com/item?id=50176735
pxtail 15 hours ago How does it work that some service that most people never heard of distributes (paid) images with alleged fix for vuln 24h before official vuln fix/image is available? Seems somewhat shady. windowsworkstoo 15 hours ago thats chainguard’s entire value prop (they are quite well known in this sphere) jsploit 13 hours ago Good luck getting them to fix broken packages though.
windowsworkstoo 15 hours ago thats chainguard’s entire value prop (they are quite well known in this sphere) jsploit 13 hours ago Good luck getting them to fix broken packages though.
kassner 14 hours ago Is there a public announcement? I can only see PHP 8.5.11 images, but having a recent build date is not enough to say they are indeed patched. ibejoeb 12 hours ago context: https://news.ycombinator.com/item?id=50176735
How does it work that some service that most people never heard of distributes (paid) images with alleged fix for vuln 24h before official vuln fix/image is available? Seems somewhat shady.
thats chainguard’s entire value prop (they are quite well known in this sphere)
Good luck getting them to fix broken packages though.
Is there a public announcement? I can only see PHP 8.5.11 images, but having a recent build date is not enough to say they are indeed patched.
context: https://news.ycombinator.com/item?id=50176735