frontpage.
newsnewestaskshowjobs

Open Source @Github

fp.

Tell HN: I unknowingly broke the PHP RCE embargo. I am sorry.

76•petecooper•6h ago•13 comments

Ask HN: Which AI Security tool do you use and why for your repositories?

2•BehanPrW•1h ago•0 comments

Ask HN: How to deal with shipping AI-written code you don't understand?

610•rzk•3d ago•746 comments

Tell HN: 2x PHP RCE CVEs with CVSS 10.0 Incoming

285•petecooper•2d ago•62 comments

Run iOS on Android Phones

4•spicygum•8h ago•0 comments

Ask HN: How has your company adapted interviews in the AI world?

4•parthdesai•13h ago•3 comments

Toyota Releases Video of Wheelchair-Alternative Mobility Concepts in Action

13•Mobius01•19h ago•2 comments

Ask HN: How can you retrain in a field requiring expensive equipment?

14•masterchief166•1d ago•10 comments

Ask HN: Are we giving away our civilization?

12•bigwheels•18h ago•4 comments

Ask HN: How does your help desk verify someone before resetting MFA?

8•ovudus•18h ago•1 comments

Ask HN: Am I the only dev who, with the advent if AI, want to work in a forest?

12•aledevv•1d ago•13 comments

Firefox Auto-Run on Windows

3•BubbleRings•18h ago•3 comments

Open-source, cross-harness memory for AI agents

17•shakshukan•1d ago•12 comments

AMA – "Final Fantasy: The Spirits Within", milestone in CGI, is 25 years old

12•kaveh808•20h ago•5 comments

Ask HN: Financial Audit of DuckDuckGo?

9•giantg2•1d ago•2 comments

Ask HN: Does anyone else just want to disconnect from everything?

16•lualover•1d ago•22 comments

Ask HN: Dark mode for HN please? (2026)

25•Stitch4223•2d ago•12 comments

Ask HN: How do you deal with AI output of your boss?

21•okr•4d ago•18 comments

Ask HN: Do you know Bitbucket are chaning their SSH endpoints?

5•mcrmonkey•3d ago•2 comments

TI C66X / Ad Sharc+ Decompilers

5•kavinsky777•2d ago•0 comments

Ask HN: What's the biologic equivalent of allowing any two cells to communicate?

2•datas•14h ago•1 comments

Ask HN: My Gemini bill shot up suddenly to 2500 USD in one day

10•kinj28•2d ago•3 comments

What should I use instead of Firefox on Android?

2•trystrawberries•1d ago•7 comments

Ask HN: How to get the most intelligence out of your agents?

9•thechairman12•2d ago•16 comments

Ask HN: Is Wikipedia going to be obsolete soon?

2•piratesAndSons•1d ago•11 comments

Ask HN: What have you built privately with AI that you'd like to share?

9•erelong•2d ago•23 comments

GCP Europe-West2 Outage

31•jack7e•2d ago•12 comments

Tell HN: I picked up knitting while waiting for my AI agent to complete

10•amelius•4d ago•3 comments

Ask HN: Why HN dosen't have bot problem?

8•solarpunk_enthu•3d ago•8 comments

Ask HN: Time to read those programming books?

6•blinkbat•1d ago•12 comments
Open in hackernews

Tell HN: I unknowingly broke the PHP RCE embargo. I am sorry.

76•petecooper•6h ago
I posted here about the then-upcoming PHP RCEs related to CVE-2026-109618 & CVE-2026-109619. I appreciate this has had considerable knock-on effects with the schedule for co-ordinated disclosure, and created additional workload.

I am truly sorry. I take full responsibility for my actions.

It was not remotely my intention to cause any of the subsequent side effects.

At the time of posting, I didn't know about any embargo. My contact had told me there was no embargo, and her contact had told her the same thing.

As someone who follows the 4-weekly PHP release cycle and compiles it from source, my intention was to alert others in a similar position to be aware of the importance/urgency of the updates.

That clearly backfired in a pretty wild fashion. I have learned my lesson.

Comments

cwillu•5h ago
Don't be silly, you can't possibly be responsible for breaking an embargo you weren't subject to or informed about.
petecooper•5h ago
That's fair. For clarity: I take responsibility for posting on HN, without knowing the facts.
Onavo•4h ago
Not sure what you are apologizing for. It's a severely overblown bug that ended up on the front page of New York Times and the Japan Prime Minister had to get involved too. The bug itself is non trivial to exploit from just public requests to a web server so I am not sure what the hysteria is about. It's no different from the other hundred or so CVEs I see being posted or dropped everyday.

It will be headlines on Hacker News regardless due to sheer sensationalism, I think most DevSecOps people would rather find out the news here first than via their boss calling them after reading the morning news.

Klonoar•3h ago
The Japanese PM did not “have” to get involved.
Onavo•1h ago
Well, consider that their old IT minister has never used a computer in his life, it's probably a good thing she's the one issuing the call to update.
bell-cot•4h ago
Responsibility may include vetting your sources - is this person competent and dutiful, to actually know there's no embargo? - and researching the situation, and thinking several moves ahead, and other stuff.

Reality is that everyone has to make decisions in finite time, using the resources they actually have.

And I'd put a whole lot more responsibility further up that chain of contacts. And question how many other people they might have blabbered to.

petecooper•4h ago
>And question how many other people they might have blabbered to.

100%. I'm concerned about the two-way street this might also have opened me up to with information I shared privately with this individual. Nothing significant or incriminating, but the professional relationship is concluded.

possmap•5h ago
It happens. Information cascades are messy, especially with multi-layered contacts

Thanks for owning it ,the best thing now is ensuring the patch details are clear once the official release drops. Moving forward is what matters

rancar2•3h ago
That’s kind of you, Pete, but it was leaked and being exploited well prior to your previous posting here: https://aws.amazon.com/blogs/security/amazon-threat-intellig...
ChrisArchitect•2h ago
Related (where you already posted a bit of this):

Today's PHP security release, and how we're strengthening security

https://news.ycombinator.com/item?id=50182987

voakbasda•2h ago
Really hope you are not in the US. This kind of admission would be used against you in a civil trial, and lawyers love to sue for just about any reason under the sun. Someone could drag you to court and you might be able to defend yourself, but at an extremely painful cost both financially and emotionally. While I think that would be utter bullshit, that does seem to be the way this country operates now.
petecooper•2h ago
I am not in the US.
ivanjermakov•2h ago
The first rule of the fight club only applies if you know about the fight club.