Chainguard

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 shipped on 21 October, a day ahead of plan, after the CVE IDs leaked. Both bugs score CVSS 9.2 and need no login, and a proof-of-concept video went up by mistake.

In the thread, an admin racing across several servers said a three-line nginx rule blocking multipart uploads had been quietly protecting a machine he could not shut down.

Minimus publishes hundreds of distroless images with per-image vulnerability-reduction percentages — nginx at 100%, python at 98% — now free with no SLA or guaranteed patch timing, while paid tiers get fixes first.

The thread, with the co-founder present, circles one worry: free tiers vanish once they're load-bearing. Engineers also press on the unanswered basics — no Dockerfiles, unclear licensing, and a supply-chain trust gap against open-source Wolfi.