PHP disclosure: user apologizes over early CVE post

A Hacker News user has apologized for publishing details of two critical PHP vulnerabilities ahead of a planned disclosure embargo.

The user, who goes by petecooper, said they posted the CVE identifiers to warn others who follow PHP's four-week release cycle that the matter required urgent attention. They said they have no affiliation with any organization involved in the disclosure, describing their work as a self-employed consultant and the solo founder of a mental health non-profit run on the side. In a written statement, petecooper addressed the schedule disruption: "I appreciate this had considerable knock-on effects with the schedule for co-ordinated disclosure, and created additional workload. I am truly sorry. I take full responsibility for my actions." They added that causing such effects was never their intention, and that their contact had told them no embargo applied, a claim that contact's own source had also made.

The two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, are remote code execution flaws in the PHP runtime, each rated 9.2 in severity. They were found using AI tools rather than through attacks by malicious AI systems. The PHP Foundation had planned a controlled release so affected websites and applications could patch before the flaws became widely known. Some recipients of the advance warning did not pass along the embargo attached to the CVEs, and details circulated sooner than intended.

Petecooper was not the only source of early leaks. Several disclosures had already appeared on social media and other platforms, which led the PHP Foundation to move its announcement forward by one day. The foundation also said Chainguard broke the embargo by more than six hours. Dan Lorenc, co-founder and CEO of Chainguard, defended the decision on LinkedIn, saying he acted after speaking with several other researchers and that once the fix was released publicly, he notified the group rather than only his company's customers.

Security tools capable of finding such flaws can also shorten the window between a fix becoming available and an exploit appearing. The two PHP bugs sat in code used across many sites, and the PHP Foundation has said it moved up its announcement because details were circulating publicly.