alt Hacker NewsTell HN: I unknowingly broke the PHP RCE embargo. I am sorry.
I posted here about the then-upcoming PHP RCEs related to CVE-2026-109618 & CVE-2026-109619. I appreciate this has had considerable knock-on effects with the schedule for co-ordinated disclosure, and created additional workload.
I am truly sorry. I take full responsibility for my actions.
It was not remotely my intention to cause any of the subsequent side effects.
At the time of posting, I didn't know about any embargo. My contact had told me there was no embargo, and her contact had told her the same thing.
As someone who follows the 4-weekly PHP release cycle and compiles it from source, my intention was to alert others in a similar position to be aware of the importance/urgency of the updates.
That clearly backfired in a pretty wild fashion. I have learned my lesson.
Comments
[dead]
[dead]
[flagged]
> I take full responsibility for my actions.
I would like this to materialize, but that's just empty words.
> It was not remotely my intention to cause any of the subsequent side effects.
What were your intentions, then?
> my intention was to alert others in a similar position to be aware of the importance/urgency of the updates.
Have you lived under the stone for the past few years with respect to cybersecurity? Yes you have. All of you ignore security as in "it doesn't apply to me", "they won't break into my software because I'm truly the best 10x developer in the world" etc.
> I have learned my lesson.
I certainly doubt that. A person with IQ only a tiny bit bigger than Trump's wouldn't seek public attention so badly to disclose a security hole in a public forum.
When such praise-seeking habits have stopped being embarrassing?
Really hope you are not in the US. This kind of admission would be used against you in a civil trial, and lawyers love to sue for just about any reason under the sun. Someone could drag you to court and you might be able to defend yourself, but at an extremely painful cost both financially and emotionally. While I think that would be utter bullshit, that does seem to be the way this country operates now.
So who will be sued and/or state prosecuted?
This is definitionally humble bragging. First of all the apology is in bad faith because there is nothing to apologize for. We are all giving the discovered CVEs attention (the brag component) under the guise of an apology (the humble component). I am being downvoted by well meaning, people pleasers that don't mind if they waste our time and attention doing it. Sounds great.
Is there any insight on if this was a "Bug" or a "Sophisticated Feature" put there by state actors long ago that was now just discovered.
[dead]