frontpage.
newsnewestaskshowjobs

Open Source @Github

fp.

Quad9 (DNS Resolver) to Exit France

https://quad9.net/news/blog/au-revoir-france/
704•farrokhi•6h ago•271 comments

OpenShell – A safe, private runtime for fleets of autonomous AI agents

https://github.com/NVIDIA/OpenShell
167•niemandhier•3h ago•86 comments

Getting ready to operate GNU Taler in Germany

https://www.taler.net/en/news/2026-13.html
147•dewey•4h ago•47 comments

Show HN: Run full iOS 16.5 firmware on Android Devices

https://github.com/oosexgang/hackios-xnu-kernel
231•aghuang•5h ago•76 comments

Show HN: UI micro interactions prompts for AI

https://www.typeui.sh/micro-interactions
49•elwingo1•2h ago•20 comments

Hedra is a 3D open world game I wrote from scratch while in highschool

https://github.com/maxilevi/project-hedra/tree/pre-ai
60•maxilevi•2h ago•14 comments

Woman faces six years in prison over Cash App account she never opened

https://www.techspot.com/news/114296-woman-spends-three-nights-jail-faces-six-years.html
250•oidar•7h ago•251 comments

eMudhra to exit global SSL/TLS certificate business

https://emudhra.com/en/press-release/emudhra-to-exit-global-ssl-tls-certificate-business
824•bo0tzz•7h ago•577 comments

AI and the Enclosure of the Scientific Commons

https://arxiv.org/abs/2610.27251
48•jrepinc•2h ago•19 comments

What Is Gridifcation

https://musicalform.substack.com/p/what-is-gridifcation
344•gumby•3d ago•171 comments

Jailbreaking the Switch 2

https://pepsipu.com/blog/2026-10-switch2-jailbreak-ns2jb/
613•ledoge•12h ago•220 comments

Every AI model has the same "controversial" take on humans

https://www.modelcompare.ai/blog/ai-models-controversial-take-on-humans
69•rakannimer•4h ago•102 comments

Tell HN: I unknowingly broke the PHP RCE embargo. I am sorry.

182•petecooper•10h ago•67 comments

A farewell to Arc browser

https://arc.net/
174•suhdonghwi•4h ago•140 comments

Show HN: Turn regular JavaScript into a neural net

https://chenglou.me/handwired/
20•chenglou•1d ago•6 comments

What’s getting pwned right now

https://pwn.watch/
295•mrkd•6h ago•139 comments

The phenomena that brighten dawn and dusk (2016)

https://www.colorado.edu/asmagazine-archive/node/2039
13•NaOH•1d ago•1 comments

Mini brain organoids ‘reading’ Braille key step towards biohybrid computing

https://www.frontiersin.org/news/2026/10/16/mini-brain-organoids-reading-braille-biohybrid-comput...
25•CharlesW•4h ago•16 comments

A complete bypass of eMudhra’s 1FA OTP login system

https://mastodon.catgirl.cloud/@49016/117475976434068995
103•tensegrist•1h ago•24 comments

Xbox wants you to pay 24 to 40 cents per hour to stream games you bought

https://arstechnica.com/gaming/2026/10/xbox-wants-you-to-pay-24-to-40-cents-per-hour-to-stream-ga...
103•entryleveljobsc•9h ago•139 comments

AI analysis of CT scans finds 42.9% of patients have coronary inflammation

https://www.biograph.com/newsroom/biograph-completes-first-u.s.-study-with-caristo-diagnostics%E2...
49•brandonb•2h ago•27 comments

Dungeon Generation in the Gnomish Mines of NetHack

https://www.boristhebrave.com/2026/10/18/dungeon-generation-in-the-gnomish-mines-of-nethack/
94•ibobev•3d ago•12 comments

Faster than earcut: triangulating 3.7M map polygons in 489 ms

https://globus.software/blog/2026/10/16/cutting-map-polygons/
181•molind•11h ago•36 comments

Show HN: agent-usage-guard – a Claude Code mod to protect your usage window

https://github.com/rbartoli/agent-usage-guard
15•zzyyxx332211•2h ago•7 comments

Show HN: Uberblok – an interactive museum of ZFS internals

https://uberblok.storagebits.workers.dev/
54•storagebits•1d ago•15 comments

The Last Museum: Semantic search across 5.8M artworks from major museums

https://lastmuseum.com/
91•surprisetalk•8h ago•25 comments

Award-Winning AI Literature

https://jamesyu.org/award-winning-ai-literature/
44•jamesjyu•2h ago•40 comments

Startup taps underwater volcano as energy source in “proof point” test

https://arstechnica.com/science/2026/10/startup-taps-underwater-volcano-as-energy-source-in-proof...
114•wffurr•3d ago•47 comments

WorldTUI: I trained a 360M model to pretend to be a terminal

https://simedw.com/2026/10/21/world-model-terminal/
466•alphax314•18h ago•149 comments

MPs moving to restrict gambling ads in Canada

https://www.cbc.ca/news/investigates/gambling-ads-restrictions-canada-9.7388888
195•Teever•6h ago•105 comments
Open in hackernews

Tell HN: I unknowingly broke the PHP RCE embargo. I am sorry.

180•petecooper•10h ago
I posted here about the then-upcoming PHP RCEs related to CVE-2026-109618 & CVE-2026-109619. I appreciate this has had considerable knock-on effects with the schedule for co-ordinated disclosure, and created additional workload.

I am truly sorry. I take full responsibility for my actions.

It was not remotely my intention to cause any of the subsequent side effects.

At the time of posting, I didn't know about any embargo. My contact had told me there was no embargo, and her contact had told her the same thing.

As someone who follows the 4-weekly PHP release cycle and compiles it from source, my intention was to alert others in a similar position to be aware of the importance/urgency of the updates.

That clearly backfired in a pretty wild fashion. I have learned my lesson.

Comments

cwillu•9h ago
Don't be silly, you can't possibly be responsible for breaking an embargo you weren't subject to or informed about.
petecooper•9h ago
That's fair. For clarity: I take responsibility for posting on HN, without knowing the facts.
Onavo•7h ago
Not sure what you are apologizing for. It's a severely overblown bug that ended up on the front page of New York Times and the Japan Prime Minister had to get involved too. The bug itself is non trivial to exploit from just public requests to a web server so I am not sure what the hysteria is about. It's no different from the other hundred or so CVEs I see being posted or dropped everyday.

It will be headlines on Hacker News regardless due to sheer sensationalism, I think most DevSecOps people would rather find out the news here first than via their boss calling them after reading the morning news.

Klonoar•7h ago
The Japanese PM did not “have” to get involved.
Onavo•5h ago
Well, consider that their old IT minister has never used a computer in his life, it's probably a good thing she's the one issuing the call to update.
Fnoord•57m ago
You've used a computer the moment you aren't even born yet.
dylan604•25m ago
Okay, now I'm curious about what sci-fi trope you've gone too far down a rabbit hole in.
fouc•10m ago
[delayed]
tptacek•16m ago
What does "non trivial to exploit from just public requests" mean? It's known to be exploitable on more than one stock PHP application. This really is a 5-alarm fire.
bell-cot•8h ago
Responsibility may include vetting your sources - is this person competent and dutiful, to actually know there's no embargo? - and researching the situation, and thinking several moves ahead, and other stuff.

Reality is that everyone has to make decisions in finite time, using the resources they actually have.

And I'd put a whole lot more responsibility further up that chain of contacts. And question how many other people they might have blabbered to.

petecooper•8h ago
>And question how many other people they might have blabbered to.

100%. I'm concerned about the two-way street this might also have opened me up to with information I shared privately with this individual. Nothing significant or incriminating, but the professional relationship is concluded.

possmap•9h ago
It happens. Information cascades are messy, especially with multi-layered contacts

Thanks for owning it ,the best thing now is ensuring the patch details are clear once the official release drops. Moving forward is what matters

reboot81•6h ago
You’re setting a great example of how to be open and take responsibility, even when you’re not actually at fault. I really respect how you’ve handled this. You’ve also given the community a valuable reminder that some security disclosures may be under embargo, and that it’s worth having in mind before sharing.
rancar2•7h ago
That’s kind of you, Pete, but it was leaked and being exploited well prior to your previous posting here: https://aws.amazon.com/blogs/security/amazon-threat-intellig...
ChrisArchitect•6h ago
Related (where you already posted a bit of this):

Today's PHP security release, and how we're strengthening security

https://news.ycombinator.com/item?id=50182987

voakbasda•6h ago
Really hope you are not in the US. This kind of admission would be used against you in a civil trial, and lawyers love to sue for just about any reason under the sun. Someone could drag you to court and you might be able to defend yourself, but at an extremely painful cost both financially and emotionally. While I think that would be utter bullshit, that does seem to be the way this country operates now.
petecooper•6h ago
I am not in the US.
throw_m239339•1h ago
The parent is getting downvoted but he is absolutely right. Do not ever do what you just did. It makes you an easy target for a frivolous lawsuit in the US or in other countries because of the potential liabilities in your message, they are real. Even if you didn't do anything wrong, you are painting a target on your back, for no reason. I would ask HN to delete that thread directly.

You cannot foresee the financial/civil consequences of that RCE and some people might be looking for scapegoats in the future.

ceejayoz•56m ago
There's at least some evidence in the other direction.

https://med.stanford.edu/news/all-news/2017/10/in-patient-in...

> New research shows that discussing hospital errors with patients leads to better patient safety without spurring a barrage of malpractice claims.

throw_m239339•
ivanjermakov•6h ago
The first rule of the fight club only applies if you know about the fight club.
hanspagel•1h ago
What is the fight club?
bunderbunder•59m ago
the coordinated disclosure
gpvos•54m ago
It's a quote from a 1999 film: https://en.wikipedia.org/wiki/Fight_Club
qingcharles•19m ago
We don't talk about The Fight Club.
deadnomore•32m ago
what about the second rule of fight club?
wewewedxfgdf•2h ago
x
mindcrime•2h ago
The modern version:

You have sinned.

Your penance:

Three Hail Claude's, one Our GPT and an act of loop engineering.

Two minutes of silent prompting.

solyin•1h ago
and 1 hour, writing code, no AI.
wewewedxfgdf•42m ago
That's a bit harsh.
robrain•41m ago
What joy. Not much of a punishment.
qubex•2h ago
What does “take full responsibility” mean in the present context? Are you forfeiting all your assets and pledging the next twenty generations of your descendants into peonage?

(For clarity, I’m being facetious, but it’s a really meaningless and empty phrase to commit to the written record.)

petecooper•1h ago
>What does “take full responsibility” mean in the present context?

I posted something that -- in hindsight -- I shouldn't have, and it had repercussions for a lot of people. An action that I took had considerable knock-in effects around the world.

Some outlets are reporting that my action of posting something that I believed to be in good faith was an indicator or catalyst for the embargo to be tossed out and a previously-agreed schedule to change in short order.

That's not a normal Wednesday for me. Not even vaguely. I've not slept well since, and my taking ownership with an apology is this new course of action. Hopefully I'll sleep tonight.

re: assets and peonage – I am but a broke & wizened nerd with no known descendants. If you're ever in Cornwall, UK: look me up, I'll gladly buy you a sleep-friendly beverage. And I’m not being facetious.

zer00eyz•51m ago
Shit happens.

Years ago I lost $250K at work, well gave away, so real money out the door. I figured out why we were bleeding, that the mistake was mine (2008 vs 2009 in a function) and then changed the pattern to use explicit names rather than numbered events.

I figured at the end of the day I was fired. My boss laughed at me and told me good job for owning my mistake, fixing it, and then making sure it could not happen again.

Honestly don't just apologize - tell the whole story, in full. Tell us what you should have done differently at each step. Tell us where the process failed you and us. Those sorts of narratives and suggestions are how processes get improved. There is a humble and informative post mortem that you can write up and publish (beyond HN) for everyone's edification. But that should honestly be a Monday thing, when you have a clear head and some more perspective on the whole situation.

Honestly though, dont beat yourself up over this.

drcongo•1h ago
You're a good person with good intentions. Hope you get some rest sir.
NamlchakKhandro•47m ago
It's ok. It's just php.
dylan604•24m ago
It's okay. It's just 70% of websites.
john_strinlai•47m ago
if you received the information about the RCEs without the information about the embargo, then you did not break the embargo. someone else up the chain did.

this whole saga will be analyzed and we'll all come out better for it at the end.

kinduff•44m ago
I hope this is bait because that's not how it works.
john_strinlai•40m ago
you cannot be subject to an embargo of which you had no knowledge and took no participation in.

the embargo was already broken when pete received the information.

cperciva•39m ago
This is exactly how it works. People who are part of the embargo are responsible for making sure that anyone they share information with -- which should usually be nobody! -- are aware of and abide by the embargo.
michaelbuckbee•35m ago
So if I read the post here and told someone, would I be breaking the embargo?
kinduff•26m ago
No, you didn't. I misread.
tonymet•31m ago
Can someone, with the benefit of hindsight, explain the embargo ? Why isn't there a clause "if the vuln leaks, embargo is broken" . I still don't understand the fuss.

Everyone knew about the vuln well before the patches going live. The embargo, at that point, made things worse.

In plain english, please.

deadnomore•28m ago
This is definitionally humble bragging.
iambateman•19m ago
Thanks Pete. I appreciate you taking the time to post here.
aksss•7m ago
So.. what has the effect of this all been? I understand that the early release of POC exploits increased the pressure for mitigations in advance of the patch release and caused a lot of work and stress. I have read the tweets from Cloudflare with statistics for malformed requests related to suspected exploit attempts.

I know breaches are often kept under wraps, and there's a long tail. But is there any evidence of impact at this point? Were any sites compromised that we know about? There was a lot of hullabaloo, with foreign and domestic LE agencies recommending sites be taken offline (holy shit!).

Was this like Y2K where, but for the coordinated action of many, a real issue was addressed? Or is it like Hale Bopp where everybody watched, and a few casualties in the preparation, but ultimately a nothingburger?

Flame on!

jakelsaunders94•4m ago
Hope you're doing alright mate. Seems like an honest attempt to do the right thing to me. Get some sleep.
53m ago
It has nothing to do with anything I said.
ceejayoz•30m ago
Sure it does. Saying sorry sometimes reduces liability risk, which is quite counterintuitive at first.
throw_m239339•26m ago
> Sure it does. Saying sorry sometimes reduces liability risk, which is quite counterintuitive at first.

No it doesn't have anything to do with what I said. The OP has no contractual or legal obligations toward any community, unlike a doctor and their patients in case of medical error.

edit:

> A doctor has no contractual obligation to apologize, either.

> But it can help prevent things from going to lawsuits, versus the "fuck you I admit nothing" approach that sometimes just pisses people off.

OP isn't a doctor as far as you know, and isn't apologizing to a specific person. OP can't be bound to an embargo he didn't know about and wasn't involved in any decisions.

You're completely off topic and you just want the last word.

Your ramblings have nothing to do with anything I have said.

ceejayoz•18m ago
A doctor has no contractual obligation to apologize, either.

But it can help prevent things from going to lawsuits, versus the "fuck you I admit nothing" approach that sometimes just pisses people off.

cosmotic•39m ago
Anyone can sue anyone else for any reason. We should encourage honesty and transparency, not discourage it.
SoftTalker•33m ago
While possibly true in theory, in practice it's not. Courts and judges do not take kindly to frivolous or unsubstantiated claims, and any halfway good attorney would advise you to not waste your money and your time on a claim you are unlikely to win or be able to collect on.

People and companies do get sued with the full intention of a settlement and it never going to trial. But that only happens when the defendant has deep pockets or good insurance.

throw_m239339•30m ago
This isn't a matter of transparency, was the OP legally bound not to disclose the RCE? That whole "embargo" was pure courtesy between the people involved. The OP committed no fault at first place and the exploit was already in the wild anyway. Whoever really wanted to exploit it before the patch could without using the OP as a source.

> Anyone can sue anyone else for any reason.

And it's easier to have cause to sue when someone publish an "admission of guilt", which makes a lawsuit harder to dismiss thus costlier.

ktm5j•37m ago
Yep, everyone makes mistakes. It's the learning-from-it part that's really important.
john_strinlai•26m ago
>I figured at the end of the day I was fired. My boss laughed at me and told me good job for owning my mistake, fixing it, and then making sure it could not happen again.

i forget the origin of the story, but i loosely remember a story about a boss and employee in a similar situation. the important bit was the bosses line ($ adjusted to match your story):

"why would i fire you when i just spent $250k training you"

arto•17m ago
You may be thinking of Dale Carnegie's classic story:

> Any fool can criticize, condemn, and complain—and most fools do.

> But it takes character and self-control to understand and forgive.

> “A great man shows his greatness,” said Carlyle, “by the way he treats little men.”

> Bob Hoover, a famous test pilot and frequent performer at air shows, was returning to his home in Los Angeles from a show in San Diego. As described in the magazine Flight Operations, at three hundred feet in the air, both engines suddenly stopped. By deft maneuvering he managed to land the plane. It was badly damaged, but fortunately neither he nor his two passengers were hurt.

> Hoover’s first act after the emergency landing was to inspect the airplane’s fuel. Just as he suspected, the World War II propeller plane he had been flying had been loaded with jet fuel rather than gasoline.

> Upon returning to the airport, Hoover asked to see the mechanic who had serviced his airplane. The young man was sick with the agony of his mistake. Tears streamed down his face as Hoover approached. He had just caused the loss of a very expensive plane and could have caused the loss of three lives, as well.

> You can imagine Hoover’s anger. One could anticipate the tongue-lashing that this proud and precise pilot was about to unleash for that carelessness. But Hoover didn’t scold the mechanic; he didn’t even criticize him. Instead, he put his big arm around the man’s shoulder and said, “To show you I’m sure that you’ll never do this again, I want you to service my F51 tomorrow.”

john_strinlai•12m ago
i have a feeling it was an IBM story/legend, but my memory isn't what it used to be.

however, it's much the same in spirit as the one you posted, thanks!

herodoturtle•45m ago
> What does “take full responsibility” mean in the present context?

Aside from Pete's reply (see adjacent comment), I'd add that him taking full responsibility is also his way of saying his post was nobody else's fault but his.

In other words it's less about forfeiting assets and descendant peonage, and more about saying "the buck stops with me".

At least that's my read of his sentiment. Pete can expand if need be.

dylan604•26m ago
I know nothing of who Pete is or his associations, so any accuracy on the following speculation is purely coincidental.

"Take full responsibility" is also something someone set up as a scapegoat might say. By claiming nobody else influenced, coerced, or otherwise convinced them to make that statement, every/any one else involved can then wash their hands of the situation.

I'm merely playing devil's advocate here, and it's just a sign of the times that a person making an honest admission can be interpreted in such a manner.

petecooper•4m ago
>At least that's my read of his sentiment. Pete can expand if need be.

That's about it. Mea culpa.

Papazsazsa•42m ago
Taking responsibility for a mistake is neither meaningless nor empty, but honorable. The very essence of humanity.
axus•31m ago
It does NOT mean "He agrees to settle any financial claims against himself or his employer, for damages caused by negligence".

Could have said "I blame only myself for this mistake, nothing else needs to change".

This will keep happening until the system where this can happen runs out of willing scapegoats.

dylan604•33m ago
This is not a situation where "Ignorantia juris non excusat" applies.
kinduff•28m ago
Okay, my bad. I didn't know he was not participating in the embargo.