I've been following PHP2Shell, and while there's a lot of discussion about AI-assisted vulnerability discovery, I'm more interested in what happened around the fixes.
The PHP Foundation describes the technical and organisational difficulties involved, including limited resources, decision-making problems, and a dependence on a small number of people with deep knowledge of PHP's internals.
**2/4**
Then there's the dispute with Chainguard, which released patched images ahead of the coordinated disclosure. Chainguard points to leaks and reports of exploitation; the PHP Foundation argues that the early release exposed others to additional risk.
Who gets to make these decisions when maintainers, distributors, and commercial providers have different responsibilities?
**3/4**
I've also been watching the growing market for commercial open source remediation, from Chainguard and HeroDevs to Moderne's Backpatch Alliance and IBM/Red Hat's Lightwell.
More engineering resources for security maintenance are welcome. But does buying fixes also build lasting capacity within upstream projects? And who gets to set the priorities?
**4/4**
I wrote *Gardens, Not Roads* last year about open source projects as communities of practice, not just codebases to maintain.
Their knowledge, relationships, and governance can't be reduced to individual fixes. Can commercial remediation strengthen those communities, or are we building parallel institutions whose priorities are set elsewhere?
https://tarakiyee.com/gardens-not-roads-cultivating-open-source-communities/
@tarakiyee as someone who has worked in many different free software communities since 1994, this is so spot on. It is a great post!
