Consultant comes clean for sparking worldwide panic by accidentally breaking the PHP vulnerability embargo

retained text

Consultant comes clean for sparking worldwide panic by accidentally breaking the PHP vulnerability embargo — user says they were unaware of disclosure restrictions, move 'clearly backfired in a pretty wild fashion'
The leaks were coming from multiple users, however.
A Hacker News user who shared news about the recent PHP vulnerabilities revealed by ChatGPT Sol before an embargo, which they claimed to be unaware of, has taken to the platform to apologize for the post. According to petecooper, they shared the CVEs because they wanted to alert others who follow the four-week PHP release cycle about the importance and urgency of the matter, but they weren’t aware of the news blackout that went with the two identified vulnerabilities.
The user said they have "No connection or affiliation to any of the organisations involved." Noting, "I am a self-employed consultant for my day job, and a solo founder of a mental health non-profit on the side." Petecooper's original post about the vulnerability was among the first to break the NDA, though they claim they were unaware.
“I posted here about the then-upcoming PHP RCEs related to CVE-2026-109618 & CVE-2026-109619. I appreciate this has had considerable knock-on effects with the schedule for co-ordinated disclosure, and created additional workload. I am truly sorry. I take full responsibility for my actions,” petecooper wrote on the platform. “It was not remotely my intention to cause any of the subsequent side effects. At the time of posting, I didn’t know about any embargo. My contact had told me there was no embargo, and her contact had told her the same thing.”
CVE-2026-109618 and CVE-2026-109619 are two critical vulnerabilities, both scored at 9.2. It seemed that the PHP Foundation planned for a controlled public release, allowing affected websites and applications to be patched before the vulnerabilities became widely known. Unfortunately, it seemed that some recipients of the warning failed to share the embargo that came alongside the CVEs, spreading the news earlier than expected.
It should be noted that petecooper apparently wasn’t the only one who leaked the news early. Multiple leaks had already been circulating on social media and other platforms, which forced the PHP Foundation to move its announcement up by one day. Despite that, the organization mentioned that Chainguard broke the embargo by more than six hours. Dan Lorenc, the co-founder and CEO of Chainguard, defended the move on LinkedIn, saying that he made the call after talking to several other researchers and immediately notified the group after releasing the fix publicly, and not just his customers.
The vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619 were bugs in the PHP runtime itself that were discovered using AI tools, not attacks by rogue AI. Still, the abilities of this technology could make it easier for both security researchers and bad actors to find vulnerabilities that could have been lurking in widely used code for years, if not decades. This makes it a race to find and deploy a fix before they can be exploited.
Follow Tom's Hardware on Google News, or add us as a preferred source, to get our latest news, analysis, & reviews in your feeds.
Get Tom's Hardware's best news and in-depth reviews, straight to your inbox.
Jowi Morales is a tech enthusiast with years of experience working in the industry. He’s been writing with several tech publications since 2021, where he’s been interested in tech hardware and consumer electronics.
- DS426 Good lesson: don't ask people, ask the affected software provider. It is supposed to be coordinated disclosure after all.Reply