alt Hacker NewsTell HN: I unknowingly broke the PHP RCE embargo. I am sorry.
I posted here about the then-upcoming PHP RCEs related to CVE-2026-109618 & CVE-2026-109619. I appreciate this has had considerable knock-on effects with the schedule for co-ordinated disclosure, and created additional workload.
I am truly sorry. I take full responsibility for my actions.
It was not remotely my intention to cause any of the subsequent side effects.
At the time of posting, I didn't know about any embargo. My contact had told me there was no embargo, and her contact had told her the same thing.
As someone who follows the 4-weekly PHP release cycle and compiles it from source, my intention was to alert others in a similar position to be aware of the importance/urgency of the updates.
That clearly backfired in a pretty wild fashion. I have learned my lesson.
Comments
That’s kind of you, Pete, but it was leaked and being exploited well prior to your previous posting here: https://aws.amazon.com/blogs/security/amazon-threat-intellig...
What does “take full responsibility” mean in the present context? Are you forfeiting all your assets and pledging the next twenty generations of your descendants into peonage?
(For clarity, I’m being facetious, but it’s a really meaningless and empty phrase to commit to the written record.)
Don't be silly, you can't possibly be responsible for breaking an embargo you weren't subject to or informed about.
I really hope this isn’t chewing at you and that you’re just trying to do what you feel is the right thing by posting this.
I also got that information before your post. I believe an embargo is impossible to keep up when it takes way too long to get a fix out.
are you the guy working at Chainguard publishing images...?
The first rule of the fight club only applies if you know about the fight club.
Thanks Pete. I appreciate you taking the time to post here.
This does feel like the fix took so long to bake and was so obvious way too many people who are into PHP knew about it, I knew about eMudra's cert issue as soon as Chrome and Firefox pushed updates to disallow them for instance because of reasons, and it wasn't even fixed after it was all made public on several platforms, I think Apple still hasn't fixed it properly, the trust Store is still fucked not sure if Safari was separately patched, maybe there is an os update in the last few hours I missed.
This entire RCE race is always annoying.
Hope you're doing alright mate. Seems like an honest attempt to do the right thing to me. Get some sleep.
So who will be sued and/or state prosecuted?
[flagged]
The security field is full of a bunch of self important jagoffs that think they are “super smart”. Its all a joke and its sad that anyone feels they need to play these stupid games.
Security is important but the people in the security field are clowns and it seems it has gotten worse over the last 20 years.
Related (where you already posted a bit of this):
Today's PHP security release, and how we're strengthening security
You're a good person with good intentions. Hope you get some rest sir.
So.. what has the effect of this all been? I understand that the early release of POC exploits increased the pressure for mitigations in advance of the patch release and caused a lot of work and stress. I have read the tweets from Cloudflare with statistics for malformed requests related to suspected exploit attempts.
I know breaches are often kept under wraps, and there's a long tail. But is there any evidence of impact at this point? Were any sites compromised that we know about? There was a lot of hullabaloo, with foreign and domestic LE agencies recommending sites be taken offline (holy shit!).
Was this like Y2K where, based on the coordinated action of many, a real issue was addressed in time? Or is it like Hale Bopp where everybody watched, and a few casualties in the preparation, but ultimately a nothingburger?
Flame on!
Can someone, with the benefit of hindsight, explain the embargo ? Why isn't there a clause "if the vuln leaks, embargo is broken" . I still don't understand the fuss.
Everyone knew about the vuln well before the patches going live. The embargo, at that point, made things worse.
In plain english, please.
[flagged]
It happens. Information cascades are messy, especially with multi-layered contacts
Thanks for owning it ,the best thing now is ensuring the patch details are clear once the official release drops. Moving forward is what matters
[dead]
[dead]
Really hope you are not in the US. This kind of admission would be used against you in a civil trial, and lawyers love to sue for just about any reason under the sun. Someone could drag you to court and you might be able to defend yourself, but at an extremely painful cost both financially and emotionally. While I think that would be utter bullshit, that does seem to be the way this country operates now.
This is definitionally humble bragging. First of all the apology is in bad faith because there is nothing to apologize for. We are all giving the discovered CVEs attention (the brag component) under the guise of an apology (the humble component). I am being downvoted by well meaning, people pleasers that don't mind if they waste our time and attention doing it. Sounds great.
if you received the information about the RCEs without the information about the embargo, then you did not break the embargo. someone else up the chain did.
this whole saga will be analyzed and we'll all come out better for it at the end.