He broke the PHP RCE embargo, and says his source told him there wasn't one
A poster who goes by petecooper put two upcoming PHP remote-code-execution bugs on HN, then wrote a public apology. He says two links in a chain of contacts told him no embargo existed.
He follows the four-weekly PHP release cycle and compiles from source, so he wanted to warn people like him to update. The disclosure schedule changed after his post.
A commenter's rule: if you got the vulnerability details without the embargo, someone upstream broke it, not you.
The apology and what it claims
The Tell HN post concerns CVE-2026-109618 and CVE-2026-109619, the two PHP RCEs covered in yesterday's edition when their IDs leaked two days early. The poster says he published, did not know of any embargo, and that his contact told him there was none, as had her own contact. His stated intent was to alert others who compile PHP from source. He says he takes full responsibility and has learned his lesson.
What "full responsibility" means
A commenter asked whether that phrase means forfeiting assets. He replied in the thread:
"I posted something that -- in hindsight -- I shouldn't have, and it had repercussions for a lot of people." — the original poster
Others read the phrase as legal exposure. One commenter warned the admission could be used against him in a US civil case.
Who actually broke it
The main dispute is where the break happened.
"if you received the information about the RCEs without the information about the embargo, then you did not break the embargo. someone else up the chain did." — a commenter defending the OP
A second commenter replied that responsible-disclosure norms still apply: his own post said "a reliable source has indicated an announcement is scheduled", and security disclosures are assumed to be confidential. A third put the weight on the chain itself:
"And I'd put a whole lot more responsibility further up that chain of contacts." — a commenter who wants the people upstream questioned
The harshest voice did not believe him, arguing a person who searched for the CVE, failed, and posted anyway must have known the severity and wondered why nobody else was talking about it. The thread cannot settle that: his account is the only record of what his contacts said.
Get breakdowns like this every day
The top Hacker News stories, unpacked — by email, Telegram, or RSS.
Claude proved 239 library entry points crash-free, using about 180 million lines of Rocq
Anthropic turned the existing fuzz tests of 123 OSS-Fuzz libraries into specifications, then had Claude write machine-checked proofs about their RISC-V binaries.