Tell HN: I unknowingly broke the PHP RCE embargo. I am sorry.
I posted here about the then-upcoming PHP RCEs related to CVE-2026-109618 & CVE-2026-109619. I appreciate this has had considerable knock-on effects with the schedule for co-ordinated disclosure, and created additional workload. I am truly sorry. I take full responsibility for my actions. It was not remotely my intention to cause any of the subsequent side effects. At the time of posting, I…
We haven't written up this one. Hacker News Best has the full story — the link below goes straight to it.