Tell HN: I unknowingly broke the PHP RCE embargo. I am sorry.
A user on Hacker News issued a public apology for inadvertently violating an embargo regarding PHP Remote Code Execution (RCE) vulnerabilities. The user explained that they were misinformed about the embargo status and intended only to warn others about the urgency of security updates.
Why it matters
This incident highlights the risks of uncoordinated disclosure in cybersecurity and the importance of verifying embargoes before sharing sensitive vulnerability information.
I posted here about the then-upcoming PHP RCEs related to CVE-2026-109618 & CVE-2026-109619. I appreciate this has had considerable knock-on effects with the schedule for co-ordinated disclosure, and created additional workload. I am truly sorry. I take full responsibility for my actions. It was not remotely my intention to cause any of the subsequent side effects.
Get smarter about the news
Sign up free for a feed built around what you actually care about, Dive Deeper research on any story, and the full text of every article.
Create free accountAlready have an account? Sign in