alt Hacker NewsTell HN: I unknowingly broke the PHP RCE embargo. I am sorry.
I posted here about the then-upcoming PHP RCEs related to CVE-2026-109618 & CVE-2026-109619. I appreciate this has had considerable knock-on effects with the schedule for co-ordinated disclosure, and created additional workload.
I am truly sorry. I take full responsibility for my actions.
It was not remotely my intention to cause any of the subsequent side effects.
At the time of posting, I didn't know about any embargo. My contact had told me there was no embargo, and her contact had told her the same thing.
As someone who follows the 4-weekly PHP release cycle and compiles it from source, my intention was to alert others in a similar position to be aware of the importance/urgency of the updates.
That clearly backfired in a pretty wild fashion. I have learned my lesson.
Comments
if you received the information about the RCEs without the information about the embargo, then you did not break the embargo. someone else up the chain did.
this whole saga will be analyzed and we'll all come out better for it at the end.
It was exploited publicly even before the wide publicity following your post so the ultimate negative impact that you may be imagining, is actually quite small. Once it is publicly exploited the benefit of coordinated disclosure delays is hard to square with the risk.
That’s kind of you, Pete, but it was leaked and being exploited well prior to your previous posting here: https://aws.amazon.com/blogs/security/amazon-threat-intellig...
Don't be silly, you can't possibly be responsible for breaking an embargo you weren't subject to or informed about.
Hey man, you're probably feeling pretty shit right now.
> I have learned my lesson.
If what you've said is true, and you were not aware of the embargo... then you are not responsible.
By taking responsibility, you're actually making the whole debacle even worse, because you are clouding the actual responsible PROCESS that failed.
Note I said process, and not person. In a situation like this, the post-mortem MUST be blameless. If people are afraid or feel ashamed, and don't come forward, then that's how even worse outcomes can start getting lined up. Blameless, not even to you, but the person who told you, and who told them, all the way up the chain.
If there are people in your organization who are trying to pin this on you, you must push back. It isn't right, and it isn't fair.
What does “take full responsibility” mean in the present context? Are you forfeiting all your assets and pledging the next twenty generations of your descendants into peonage?
(For clarity, I’m being facetious, but it’s a really meaningless and empty phrase to commit to the written record.)
> At the time of posting, I didn't know about any embargo. My contact had told me there was no embargo, and her contact had told her the same thing.
I'm not saying it needs to be a public burning, but I sure hope someone figures out who dropped the critical metadata bit so they can avoid telling that party critical things in the future.
As an Australian I thank you. I'd much rather have spent all day today patching things than tomorrow. It's Friday afternoon right now!
There's a rule about not pushing to prod on Friday. I feel the same should apply for security patches ;-)
You were not under any embargo. This only goes for the first person in the chain, whoever that was and there is absolutely nothing to apologize for.
The first rule of the fight club only applies if you know about the fight club.
I don’t know if embargoes have much effect anymore. They used AI to find this issue, meaning anyone else could also find the issue with time and the right model. The clock is always ticking after a CVE but now it ticks faster. I am certain that companies like Cellebrite are pointing a bunch of models at popular repos and filing away all the exploits they find in a database.
"You never blow the cover of an agent in the field." --Jackson Lamb
I also got that information before your post. I believe an embargo is impossible to keep up when it takes way too long to get a fix out.
Don't feel too bad. Just knowing a "10.0" RCE CVE is inbound w/o extra details doesn't get you very far. The actions of calif.io and Chainguard after your post was what caused the damage.
All vulnerabilities should be disclosed immediately, publically. That would over a short time lead to much better security practices.
Thanks Pete. I appreciate you taking the time to post here.
I really hope this isn’t chewing at you and that you’re just trying to do what you feel is the right thing by posting this.
The only bad guys here are those who exploit issues like this for unethical reasons.
You clearly aren't that person.
Regarding your perceived mistake, we all make them.
Please forgive yourself and understand that the negative feelings and thoughts you are having are a mark of decency but do not represent reality, and if they persist please seek help to get you back on track.
As an aside, to you and those like you who take on the task of fighting and protecting against these attacks with often nothing to gain except hurt like this:
Thank you for your service.
It's ok. Hopefully people took it seriously and updated quickly.
“I don't get it. Why are they confessing?” “They're not confessing.” “They're bragging.”
Hope you're doing alright mate. Seems like an honest attempt to do the right thing to me. Get some sleep.
Nah, you just repeated something that to you was a rumor.
Honestly this has been the most fun week I've had, thanks to this leak. I'm grateful. Fun stuff happened, shitty companies learned the value of capable and fast engineering teams.
All in all, I think this leak increased the value of developers, so I am thankful for your leak.
There are companies whose "rogue" agents have hacked 6 7 companies and at least 2 3 govts. They haven't faced any consequences at all! They actually hacked into those companies
And there is you who is taking responsibility for an embargo you did not know about!!
Who told you about it?
> I take full responsibility for my actions.
Meaning? Like... global financial fallout?
> I have learned my lesson.
Meaning? Like... feel bad for a week, and then back to normal?
are you the guy working at Chainguard publishing images...?
Related (where you already posted a bit of this):
Today's PHP security release, and how we're strengthening security
hey Pete, don't carry the world upon your shoulders
So much pearl clutching from these security companies. An embargo isn’t an enforceable contract, expect it to leak and be ready to fast forward your plan. Don’t start pointing fingers because people protected themselves or their customers once the dam broke.
This does feel like the fix took so long to bake and was so obvious way too many people who are into PHP knew about it, I knew about eMudra's cert issue as soon as Chrome and Firefox pushed updates to disallow them for instance because of reasons, and it wasn't even fixed after it was all made public on several platforms, I think Apple still hasn't fixed it properly, the trust Store is still fucked not sure if Safari was separately patched, maybe there is an os update in the last few hours I missed.
This entire RCE race is always annoying.
i forgive you
You're a good person with good intentions. Hope you get some rest sir.
It was a good thing. It started useful conversations and taught valuable lessons that we probably wouldn't have faced with a more "traditional" vuln disclosure/patch process. We're going to see this a whole lot more with AI, probably as 0-days. It's better that we got the fire drill out of the way now.
OP is being a big man about this
Good shit
You broke nothing, it's just another day my guy. Go for a walk, drink some water, you know, take care of yourself - others failed to follow a process, not like you threw out POCs left and right.
The security field is full of a bunch of self important jagoffs that think they are “super smart”. Its all a joke and its sad that anyone feels they need to play these stupid games.
Security is important but the people in the security field are clowns and it seems it has gotten worse over the last 20 years.
Yeah, I actually first heard it here from you.
So.. what has the effect of this all been? I understand that the early release of POC exploits increased the pressure for mitigations in advance of the patch release and caused a lot of work and stress. I have read the tweets from Cloudflare with statistics for malformed requests related to suspected exploit attempts.
I know breaches are often kept under wraps, and there's a long tail. But is there any evidence of impact at this point? Were any sites compromised that we know about? There was a lot of hullabaloo, with foreign and domestic LE agencies recommending sites be taken offline (holy shit!).
Was this like Y2K where, based on the coordinated action of many, a real issue was addressed in time? Or is it like Hale Bopp where everybody watched, and a few casualties in the preparation, but ultimately a nothingburger?
Flame on!
Can someone, with the benefit of hindsight, explain the embargo ? Why isn't there a clause "if the vuln leaks, embargo is broken" . I still don't understand the fuss.
Everyone knew about the vuln well before the patches going live. The embargo, at that point, made things worse.
In plain english, please.
[flagged]
[dead]
It happens. Information cascades are messy, especially with multi-layered contacts
Thanks for owning it ,the best thing now is ensuring the patch details are clear once the official release drops. Moving forward is what matters
[dead]
[flagged]
[dead]
> At the time of posting, I didn't know about any embargo. My contact had told me there was no embargo, and her contact had told her the same thing.
If you're not a party to an embargo, and no one told you an embargo even exists... you should not follow the embargo. In fact, you should maybe even consider leaking basic details or challenging the embargo if you are in this situation. In your situation, they had lost information asymmetry before the news got to you. I don't know where people got the idea that unrelated third parties have to follow embargos.
Embargos are not about keeping secrets, they are about the game theory of coordinated disclosure.