GoKawiilHacker News poster apologizes for early leak of PHP CVE-2026-109618/109619
A Hacker News user named petecooper publicly apologized after posting details of two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, ahead of a coordinated disclosure embargo. They said contacts had told them no embargo existed, and that they only wanted to warn others following PHP's four-week release cycle. The PHP Foundation had to move up its official announcement after multiple leaks, including one from Chainguard, surfaced before the planned release.
GoKawiil's interpretation of the reporting above, not reported fact.
The incident shows how fragile coordinated vulnerability disclosure can be when information passes through multiple informal channels before reaching the public. Early leaks can undercut the purpose of embargoes, which are meant to give developers time to patch before attackers exploit flaws, suggesting organizations may need clearer communication chains with contributors and partners. Chainguard's CEO defending his company's early disclosure indicates disagreement within the security community over how strictly such embargoes should be honored.
- Hacker News user petecooper apologized for prematurely revealing two critical PHP vulnerabilities before an embargo lifted.
- CVE-2026-109618 and CVE-2026-109619, both scored 9.2, were affected, prompting the PHP Foundation to move up its announcement.
- Chainguard also broke the embargo by over six hours, a decision its CEO Dan Lorenc defended publicly on LinkedIn.
Source: tomshardware.com — Jowi Morales, 2026-10-23
Published there as: “Devastated forum user who accidentally broke the PHP news embargo comes clean”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.