Over 100 vendors. Weeks of coordination. A Friday release window everyone agreed on. Chainguard threw it all out the window. When PHP's security team was quietly working with more than 100 downstream vendors to simultaneously patch two critical remote code execution vulnerabilities (php2shell), Chainguard unilaterally published patched container images more than six hours before the coordinated release. That single decision handed attackers a working blueprint. They could diff Chainguard's fixed images, reverse-engineer the vulnerability, and start exploiting unpatched servers long before most organizations even knew a patch existed. This is how coordinated disclosure is supposed to work: everyone patches at the same time, so there's no window where attackers know and defenders don't. Chainguard reduced that window to zero for its customers and blew it wide open for everyone else. PHP's maintainers said Chainguard "disregarded weeks of work by many parties." That is a polite way of saying one company's act overrode the security of the entire web. Responsible disclosure is a community contract. When one party breaks it, everyone outside that party's customer base pays the price.