Tell HN: I unknowingly broke the PHP RCE embargo. I am sorry.
- ID
- 38680
- Status
- summarized
- Published
- 22 Oct 2026, 6:11 PM
- Fetched
- 23 Oct 2026, 4:59 PM
- Provider
- Hacker News
- Category
- dev-community
- Original URL
- https://news.ycombinator.com/item?id=50193416
- Source URL
- https://hnrss.org/best
Summary
- Score
- 7.0
- Created
- 23 Oct 2026, 4:59 PM
- Tags
- Audience
- developersvibe_coderssaas_startup_founders
What happened
petecooper posted a Tell HN apologizing for disclosing then-upcoming PHP RCEs tied to CVE-2026-109618 and CVE-2026-109619 without knowing an embargo existed; he says his contact and her contact both told him there was no embargo. The post drew 542 points and 212 comments and disrupted the coordinated disclosure schedule, adding workload. He says his intent was to alert others following the 4-weekly PHP release cycle who compile PHP from source.
Why it matters
If you run or self-compile PHP, treat CVE-2026-109618/109619 as active disclosure chaos rather than a clean advisory: watch the next 4-weekly PHP release and patch, and don't assume embargo discipline will keep exploit details quiet—commenters say demos circulated up to 18 hours before release. Founders should ask whether their PHP stack (WordPress/Laravel included) has a named owner for this patch.
Discussion angle
What should a developer do when they hear about a vulnerability but can't confirm an embargo—post, ask privately, or wait—and how should small teams verify disclosure status before amplifying?