Hacker News user apologizes for posting PHP flaw details ahead of disclosure embargo

A Hacker News user who posted details of two critical PHP vulnerabilities before a planned disclosure embargo ended has publicly apologized, saying they had no idea such a restriction existed.

The user, who goes by petecooper, said they shared the CVEs to warn others who follow PHP's four-week release cycle that the matter was important and urgent. They said they had no connection or affiliation to any of the organizations involved, describing themselves as a self-employed consultant and the solo founder of a mental health non-profit that they run on the side.

In their statement, petecooper referred to the then-upcoming PHP remote code execution flaws tracked as CVE-2026-109618 and CVE-2026-109619. "I appreciate this has had considerable knock-on effects with the schedule for co-ordinated disclosure, and created additional workload. I am truly sorry. I take full responsibility for my actions," they wrote. They added that causing side effects was never their intention, and that their contact had said there was no embargo, a claim that contact's own source had also made.

Both vulnerabilities are rated 9.2 in severity. The PHP Foundation appeared to have planned a controlled public release, which would give affected websites and applications time to apply patches before the flaws became widely known. However, some recipients of the advance warning apparently did not pass along the embargo that accompanied the CVEs, and word spread sooner than intended.

Petecooper was not the only source of early leaks. Several had already been circulating on social media and other platforms, which pushed the PHP Foundation to bring its announcement forward by one day. The foundation also said that Chainguard broke the embargo by more than six hours.

Dan Lorenc, co-founder and CEO of Chainguard, defended the decision on LinkedIn. He said he acted after speaking with several other researchers, and that once the fix was released publicly, he promptly notified the group rather than only the company's customers.

The two flaws are bugs in the PHP runtime itself and were found using AI tools; they were not the result of attacks by rogue AI. Even so, such tools could help both security researchers and malicious actors uncover vulnerabilities that may have sat in widely used code for years or even decades. That turns each discovery into a race to develop and deploy a fix before the flaw can be exploited.