A Hacker News user has apologized for posting about two unreleased PHP remote code execution flaws, saying the post disrupted the coordinated disclosure schedule.
The apology, also posted on Hacker News, says the earlier post covered the then-upcoming PHP fixes tied to CVE-2026-109618 and CVE-2026-109619. Remote code execution (RCE) means a flaw that lets an attacker run their own code on someone else's machine. The poster wrote that the post had "considerable knock-on effects" for the disclosure schedule and created additional workload. The apology drew 115 points and 22 comments.
The poster's explanation is that they did not know about any embargo. They wrote that a contact told them there was none, and that the contact's own contact had said the same. They also wrote that they follow PHP's 4-weekly release cycle and compile it from source, and that they meant to warn others in the same position about the urgency of the updates.
An embargo is the usual tool here. Under coordinated disclosure, maintainers and researchers keep details private until a fix is ready, so users can patch before attackers learn where to look. Even a bare mention that serious RCEs are coming can be useful to someone watching for them, which is why the schedule matters.
The account describes a two-step chain of secondhand assurances. Nothing in the post says who the contacts are, and the poster's version cannot be checked from the post alone. What it does show is how a single "no embargo" claim, repeated down a line of people, can stand in for confirmation from the project itself.
Several things are unknown. The apology does not say how the PHP team responded, whether the disclosure schedule moved or by how much, or whether the fixes have shipped. Those answers would show how costly the post was, and the poster's own account stops short of them.