GoKawiilHacker News poster apologizes for breaking embargo on PHP RCE flaws CVE-2026-109618/109619
A Hacker News user has publicly apologized for prematurely disclosing details of two upcoming PHP remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, before the coordinated disclosure embargo lifted. The poster says they were told by a contact that no embargo existed and only meant to warn fellow PHP users who build from source about the urgency of upcoming patches.
GoKawiil's interpretation of the reporting above, not reported fact.
The incident illustrates how miscommunication along informal disclosure chains can disrupt coordinated vulnerability disclosure, potentially giving attackers early knowledge of exploitable flaws before official patches and advisories are ready. It may prompt security researchers and the PHP maintainers to tighten how embargo information is communicated to third parties to prevent similar leaks in the future.
- Two PHP RCE vulnerabilities, CVE-2026-109618 and CVE-2026-109619, were disclosed early due to a miscommunication about an embargo.
- The poster claims they were misinformed by a contact that no embargo was in place.
- The early disclosure reportedly disrupted the coordinated release schedule and added extra work for those managing the disclosure.
Source: news.ycombinator.com, 2026-10-22
Published there as: “Tell HN: I unknowingly broke the PHP RCE embargo. I am sorry.”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.