Petecooper has apologized in a Hacker News follow-up after an earlier post about then-upcoming PHP RCE issues tied to CVE-2026-109618 and CVE-2026-109619. The author says the post had knock-on effects for the coordinated disclosure schedule and created additional work. Those consequences were not intended.

Petecooper says they were unaware of any embargo because a contact had said none existed, based on information from another contact. They follow PHP’s four-week release cycle and compile PHP from source. The stated aim was to alert people with similar setups to the urgency of the updates.

After a commenter argued that Petecooper could not be responsible for an embargo they had not been told about, the author clarified that the responsibility accepted was for publishing on Hacker News without knowing the facts.