alt Hacker NewsThere is no way he didn't recognize the severity and massive impact of the vulnerabilities, go and try to find the CVE, fail to do so, think nothing of not being able to find it, and post.
We're also supposed to believe he didn't wonder why nobody else in his social media circles, lists, and forums were talking about it? He says he did what he did because he wanted to let people know.
We're supposed to believe he didn't stop and think "gosh, why is it falling to me to let people know about this?" It was mainstream media news less than 12 hours after it was announced.
Replies
If you're seriously asking whether or not it's possible that someone was overconfident and thoughtless rather than malicious and calculating... yeah I find that very easy to believe. Process safety exists because as individuals and as groups we suck at this.
By now I've seen at least 5 different people or companies blamed for leaks or releasing fixes early.
If anyone is at fault here, I'm looking at the PHP maintainers.
The embargo apparently held for like two months, during which they have not managed to release patches.