HN author apologizes over premature PHP RCE post
Petecooper has apologized on Hacker News for an earlier post about the expected PHP RCE disclosures CVE-2026-109618 and CVE-2026-109619.
The author says they did not know an embargo existed because two contacts had passed on that information. They accept responsibility for publishing the post and say the disruption to coordinated disclosure was unintended.
Petecooper has apologized in a Hacker News follow-up after an earlier post about then-upcoming PHP RCE issues tied to CVE-2026-109618 and CVE-2026-109619. The author says the post had knock-on effects for the coordinated disclosure schedule and created additional work. Those consequences were not intended.
Petecooper says they were unaware of any embargo because a contact had said none existed, based on information from another contact. They follow PHP’s four-week release cycle and compile PHP from source. The stated aim was to alert people with similar setups to the urgency of the updates.
After a commenter argued that Petecooper could not be responsible for an embargo they had not been told about, the author clarified that the responsibility accepted was for publishing on Hacker News without knowing the facts.
Readers’ Forum
No contributions yet — open the debate.
Open the discussion
No account or password needed — just enter your e-mail and we’ll send you a one-time sign-in link. First time here? You’re set up automatically.
Your rating will be applied automatically after you sign in.
Check your inbox
We’ve sent a sign-in link to …. Open it on this device — this tab will sign you in automatically.
Nothing arrived? Check your spam folder — and mark the mail as "Not spam" so it lands in your inbox next time.