Tell HN: I unknowingly broke the PHP RCE embargo. I am sorry.

Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Tell HN: I unknowingly broke the PHP RCE embargo. I am sorry. 22 points by petecooper1 hour ago | hide | past | favorite | 1 comment I posted here about the then-upcoming PHP RCEs related to CVE-2026-109618 & CVE-2026-109619. I appreciate this has had considerable knock-on effects with the schedule for co-ordinated disclosure, and created additional workload. I am truly sorry. I take full responsibility for my actions. It was not remotely my intention to cause any of the subsequent side effects. At the time of posting, I didn't know about any embargo. My contact had told me there was no embargo, and her contact had told her the same thing. As someone who follows the 4-weekly PHP release cycle and compiles it from source, my intention was to alert others in a similar position to be aware of the importance/urgency of the updates. That clearly backfired in a pretty wild fashion. I have learned my lesson. Don't be silly, you can't possibly be responsible for breaking an embargo you weren't subject to or informed about. | | | | | | | Search: