A Hacker News user posted about upcoming PHP remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, before coordinated disclosure was complete. The post caused knock-on effects on the disclosure schedule and added workload for others, prompting a public apology from the poster.
The poster said they were unaware of any embargo. Their contact had told them there was no embargo, and that contact's own source had said the same. As someone who follows PHP's four-weekly release cycle and compiles it from source, they said they meant to alert others to the urgency of the updates. They wrote that the post "clearly backfired" and that they had learned their lesson.
Commenters largely pushed back on blaming the poster. Many argued that responsibility lies with whoever shared the information under embargo, not with someone who was never told of it. Others questioned whether the poster should have noticed that the CVE could not be found and that nobody else was discussing it. Some commenters also criticized the PHP maintainers, noting the embargo held for about two months without patches being released.
Debate continued over the severity of the bugs. One commenter said the vulnerabilities are exploitable on more than one stock PHP application and called it a "5-alarm fire." Another argued the bug is not trivial to exploit through ordinary public requests and compared it to the many other CVEs posted daily.
Source: Hacker News · Summarized by HeadlinesBriefing