{"by":"petecooper","descendants":266,"id":50193416,"kids":[50202361,50200322,50195162,50193835,50203948,50199396,50202961,50196080,50202884,50202183,50195688,50213382,50229310,50206471,50219474,50209471,50202837,50201448,50202009,50204158,50204952,50214819,50201846,50206428,50200685,50209286,50205771,50201608,50204112,50206031,50201616,50206402,50207108,50200190,50204444,50204892,50202730,50200853,50207972,50207486,50205237,50201571,50219789,50204036,50206609,50224853,50203115,50203876,50203157,50201628,50200832,50203766,50200538,50207147,50204143,50204222,50216964,50202032,50202093,50203694,50205117,50204569,50230229,50193889,50204711,50229538,50201304,50208513,50205238,50203511,50200525,50194880,50203042,50208134,50201633,50198993,50200311,50195988,50200583,50201180,50204049],"score":735,"text":"I posted here about the then-upcoming PHP RCEs related to CVE-2026-109618 & CVE-2026-109619. I appreciate this has had considerable knock-on effects with the schedule for co-ordinated disclosure, and created additional workload.

I am truly sorry. I take full responsibility for my actions.

It was not remotely my intention to cause any of the subsequent side effects.

At the time of posting, I didn't know about any embargo. My contact had told me there was no embargo, and her contact had told her the same thing.

As someone who follows the 4-weekly PHP release cycle and compiles it from source, my intention was to alert others in a similar position to be aware of the importance/urgency of the updates.

That clearly backfired in a pretty wild fashion. I have learned my lesson.","time":1792663904,"title":"Tell HN: I unknowingly broke the PHP RCE embargo. I am sorry","type":"story"}