Tell HN: I unknowingly broke the PHP RCE embargo. I am sorry.

Hacker News Top 10/22/26, 10:11 AM News

php security rce cve coordinated-disclosure vulnerability

Summary

A Hacker News poster apologizes for unknowingly breaking the embargo on two critical PHP remote code execution vulnerabilities (CVE-2026-109618 and CVE-2026-109619), disrupting the coordinated disclosure schedule.

I posted here about the then-upcoming PHP RCEs related to CVE-2026-109618 & CVE-2026-109619. I appreciate this has had considerable knock-on effects with the schedule for co-ordinated disclosure, and created additional workload.I am truly sorry. I take full responsibility for my actions.It was not remotely my intention to cause any of the subsequent side effects.At the time of posting, I didn't know about any embargo. My contact had told me there was no embargo, and her contact had told her the same thing.As someone who follows the 4-weekly PHP release cycle and compiles it from source, my intention was to alert others in a similar position to be aware of the importance/urgency of the updates.That clearly backfired in a pretty wild fashion. I have learned my lesson.

Original Article

Similar Articles

Widespread PHP Flaw May Cause Many Site Outages Today

Krebs on Security

Two critical PHP zero-day vulnerabilities (CVE-2026-109618 and CVE-2026-109619) affecting PHP 5.4 and later are being exploited in the wild, prompting an emergency PHP release and outages across countless sites, with OpenAI and Wiz involved in the research and disclosure.

Today's PHP Security Release, and How We're Strengthening PHP Security

Simon Willison's Blog

PHP 8.x 全系发布紧急安全更新，修复两个远程代码执行漏洞；因协调披露流程泄露导致 PoC 提前扩散，PHP Foundation 与 Wiz 公布了完整披露时间线。

The disastrous PHP vulnerabilities were exploited days before the patch

The Verge

黑客在 PHP 两个严重漏洞（CVE-2026-109618、CVE-2026-109619）正式补丁发布前几天就已尝试利用，据 Amazon Threat Intelligence 报告，其蜜罐系统在 10 月 17 日即检测到 PHP2Shell 攻击活动。PHP Foundation 承认修复因兼容性问题被拖延，并表示将加快未来漏洞的处理流程。

Hackers Exploited the PHP Vulnerabilities Days Before They Were Patched

Wired

AWS threat intelligence reveals attackers began exploiting the critical PHP2Shell vulnerabilities four days before their public disclosure and patch release, highlighting how AI-accelerated exploit development is shrinking the window between patch and working exploit.

AI-assisted php2shell exploit chain hits PHP runtime, forces coordinated defense across 70% of web

Reddit r/artificial

Two critical PHP runtime vulnerabilities (CVE-2026-109618 and CVE-2026-109619, dubbed php2shell) that had existed for over a decade were demonstrated as exploitable with the help of frontier AI models, prompting a coordinated defense across the web including pre-disclosure Cloudflare WAF protections.