Over 100 vendors. Weeks of coordination. A Friday release window everyone agreed on. Chainguard threw it all out the window. When PHP's security team was quietly working with more than 100 downstream vendors to simultaneously patch two critical remote code execution vulnerabilities (php2shell), Chainguard unilaterally published patched container images more than six hours before the coordinated release. That single decision handed attackers a working blueprint. They could diff Chainguard's fixed images, reverse-engineer the vulnerability, and start exploiting unpatched servers long before most organizations even knew a patch existed. This is how coordinated disclosure is supposed to work: everyone patches at the same time, so there's no window where attackers know and defenders don't. Chainguard reduced that window to zero for its customers and blew it wide open for everyone else. PHP's maintainers said Chainguard "disregarded weeks of work by many parties." That is a polite way of saying one company's act overrode the security of the entire web. Responsible disclosure is a community contract. When one party breaks it, everyone outside that party's customer base pays the price.

Tuxdle #37 1/6 Can you beat my score? 🟩🟩🟩🟩🟩🟩 Play at tuxdle.com/

The Brax Wink is a 4-inch phone that runs BraxOS and has a keyboard that clips onto the back. itsfoss.com/news/brax-wink-p…

Not all codes are generated equally. Researchers found Alibaba's open-weight Qwen3-Coder generates code with 19% more security vulnerabilities when building apps for US defense contractors, and 28% more data leak risks for Hong Kong democracy groups. The same model write tighter code for Chinese enterprise clients. The model is actively used to self-host AI coding assistants on Linux. This is why we need more than just open-weight models. We need complete open source models.

AI is cloning office suites and it can reverse engineer apps for you. Also, people are fixing their smart TVs with AI. Check out the latest Local AI Weekly newsletter. itsfoss.com/newsletter/local…

How to properly secure your server from the impending php2shell apocalypse

The new name covers the shell, greeter, search, system monitor, calendar, and file manager, all released as part of DMS 2.0. itsfoss.com/news/dank-linux-…

Planning to get certified? You can get CKS and KCSA for 40% less and 35% off most other Linux Foundation certifications. Offer ends October 23. itsfoss.com/news/lf-cyber-se…