GoKawiilHacker News poster apologizes for breaking embargo on PHP RCE flaws CVE-2026-109618/109619
A Hacker News user has publicly apologized for prematurely disclosing details of two upcoming PHP remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, before the coordinated disclosure embargo lifted. The poster says they were told by a contact that no embargo existed and only meant to warn fellow PHP users who build from source about the urgency of upcoming patches.