> 3. Chainguard sees dancing anime video, doesn't recognize Calif, and thinks the exploit is in the wild

I'm not sure about this part. I saw https://jackalsyn.com/posts/php-up-2026.html going around a bit over 12 hours ago, before the chainguard images went out, and plenty of other chatter of exploitation happening in the wild.