Tell HN: I unknowingly broke the PHP RCE embargo. I am sorry.
I posted here about the then-upcoming PHP RCEs related to CVE-2026-109618 and CVE-2026-109619, not knowing there was an embargo. My contact had told me there was no embargo, and her contact had told her the same. As someone who follows the 4-weekly PHP release cycle and compiles it from source, my intention was to alert others in a similar position about the importance and urgency of the updates, but that clearly backfired in a pretty wild fashion. I take full responsibility for my actions and am truly sorry for the knock-on effects on the coordinated disclosure schedule and the additional workload it created.
- john_strinlai
if you received the information about the RCEs without the information about the embargo, then you did not break the embargo. someone else up the chain did.
this whole saga will be analyzed and we'll all come out better for it at the end.
- rancar2
That’s kind of you, Pete, but it was leaked and being exploited well prior to your previous posting here: https://aws.amazon.com/blogs/security/amazon-threat-intellig...
- cwillu
Don't be silly, you can't possibly be responsible for breaking an embargo you weren't subject to or informed about.
- deadnomore
This is definitionally humble bragging.
- ivanjermakov
The first rule of the fight club only applies if you know about the fight club.