HN Explorer

Tell HN: I unknowingly broke the PHP RCE embargo. I am sorry

1 points by petecooper ↗ HN
I posted here about the then-upcoming PHP RCEs related to CVE-2026-109618 & CVE-2026-109619. I appreciate this has had considerable knock-on effects with the schedule for co-ordinated disclosure, and created additional workload.

I am truly sorry. I take full responsibility for my actions.

It was not remotely my intention to cause any of the subsequent side effects.

At the time of posting, I didn't know about any embargo. My contact had told me there was no embargo, and her contact had told her the same thing.

As someone who follows the 4-weekly PHP release cycle and compiles it from source, my intention was to alert others in a similar position to be aware of the importance/urgency of the updates.

That clearly backfired in a pretty wild fashion. I have learned my lesson.

254 comments

[ 1.9 ms ] story [ 33.7 ms ] thread
cwillu
Don't be silly, you can't possibly be responsible for breaking an embargo you weren't subject to or informed about.
petecooper
That's fair. For clarity: I take responsibility for posting on HN, without knowing the facts.
Onavo
Not sure what you are apologizing for. It's a severely overblown bug that ended up on the front page of New York Times and the Japan Prime Minister had to get involved too. The bug itself is non trivial to exploit from just public requests to a web server so I am not sure what the hysteria is about. It's no different from the other hundred or so CVEs I see being posted or dropped everyday.

It will be headlines on Hacker News regardless due to sheer sensationalism, I think most DevSecOps people would rather find out the news here first than via their boss calling them after reading the morning news.

Klonoar
The Japanese PM did not “have” to get involved.
Onavo
Well, consider that their old IT minister has never used a computer in his life, it's probably a good thing she's the one issuing the call to update.
Fnoord
You've used a computer the moment you aren't even born yet.
dylan604
Okay, now I'm curious about what sci-fi trope you've gone too far down a rabbit hole in.
ang_cire
"The sonogram or EKG machine is a computer, so the baby used a computer, checkmate!"
bombcar
Well the old definition of computer was women with abacuses so I guess you could stretch that.
Fnoord
Everything which contains a microchip [1] is a computer, and you used it (or: 'it was used on you') with an echoscope around when you were in womb for around 20 weeks. Computers are everywhere, and it matters in this context: some minister saying they never used a computer (any computer) is something which is so unlikely (I mean, even a traffic light contains a computer) that it matters how it gets (strictly) defined. Nowadays, it is even more complex, given smartphones, smartTVs, laptops being used on elementary school, etc.

[1] https://www.asml.com/en/technology/all-about-microchips/micr...

NetMageSCW
Used is pretty clearly defined and none of those examples are “used”.
Fnoord
It was used on you, you were subjected to it. You cannot avoid that. That's the entire point. Before you get born, a computer is used to assess your health. If you want to watch TV, well you can't buy a TV without a computer anymore. Anything which uses the internet contains a computer with TCP/IP stack. Going on school in my country almost guarantees you end up with Chromebook or large touchscreen in classroom.

So when someone in West says they never used a computer in 2026 (or even just this decade) I don't believe them, unless they're so old they never used a mobile phone, don't watch any TV, and live like really sheltered like a hermit in some squad. A policitian needs to communicate; they surely use computers during their endeavor. Even the very old POTS is essentially also computers, same with old CRT TVs, ATMs, or computers used during public transport.

Ergo, the point is they've almost surely used computers; theyare just not aware how omnipresent computers are in our world,and ut isn't even a recent change either (the recent chamge is that they're 'smart' ie. 'networked' (TCP/IP stack).

tptacek
What does "non trivial to exploit from just public requests" mean? It's known to be exploitable on more than one stock PHP application. This really is a 5-alarm fire.
CER10TY
I think people are just latching onto the post that hit the front page earlier today about it being non-trivial to exploit, combined with the fact that there seem to be about a billion PoC out there, most of which don't work.
Onavo
The most direct exploit requires a compromised supply chain which ranks it about as dangerous as your usual dependency exploits.
CER10TY
Say what you will about OpenAI, Wiz etc but if OpenAI, Wiz, Cloudflare, the PHP Foundation and pretty much every CERT out there together recommend to take down PHP apps and patch immediately then I'm very much inclined to follow that advice.

Due to the insane media coverage there'll of course be a deluge of PoCs, most of which won't work. But constantly refreshing Twitter to see whether there's a working PoC is not a good use of time nor a great security strategy.

tptacek
Right, that's what's worrying me. It is not interesting that the most widely circulated public POC/demos don't work. All you should care about is the (currently) non-public POCs that do work, of which there are apparently several.
cookiengineer
My PoC (generated) was able to exploit an index.php with a simple echo.

The only thing you have to know in advance is the relative memory offset distances, and that's it. Memory feng shui was the longest part of the implementation.

[1] https://github.com/cookiengineer/actual-php2shell

cluckindan
Did you even read the diff, it synthesized intentionally vulnerable code which trivializes the exploitability
what
I would assume he didn’t read anything in the repo. It also requires disabling ASLR.
cookiengineer
Eh, no?

It is split up into two branches and demos, see the heap feng shui document?

ASLR enabled requires a way to create more data, which I intentionally did not create in the index.php because other folks claimed that is "cheating". That was the demo that wiz created.

Maybe you should read the repo next time? The whole point of this demo is that the assumed to be hard part (mem feng shui) is what LLMs are actually good at.

[deleted]
(comment deleted)
jgalt212
why read the diff? my AI agent reads the diff and ignores stuff it knows I don' want to hear.
wltyn
saving this to show to my students how NOT to act
saghm
How would you even know whether you knew the facts? It sounds like what you knew was more than just consistent with there being no embargo, you were explicitly told there was no embargo. After a certain point, there's a limit to how far up the chain any of us can be expected to follow the logical chain of what we genuinely think are true, and this doesn't seem like a glaringly obvious case where you were being reckless.

We're all (well, I guess not all, but the group that's worth caring about, and I hope it's at least most) just operating the best we can on the information we have and trying to make decisions based on that. As long as you're acting in good faith on information that you had genuine basis for believing is true, it seems like it would be unreasonable to expect someone in your situation to somehow intuit that you were given false information or grossly misunderstood what sounds like a pretty straightforward declaration of fact from someone you didn't have any reason to doubt.

At the risk of some armchair paycholoanalysis because it does seem like you genuinely feel some guilt over this: I can emphathize feeling guilty about the outcome of an action that in a vacuum would not have been hard to make differently, but my experience is that those of us who have a nasty habit of beating ourselves up over things when we really don't have much blame will often recognize when on the other side that it would not be fair to hold someone else to that standard. I struggle a lot with how sometimes knowing something is true doesn't always make it feel true, and even though hearing someone else saying it doesn't magically make it all better, I still think it's valuable to hear it from someone else, so if I happen to be right about how you're feeling, nothing about all of this is your fault, and to the extent that you're able to, try not to beat yourself up over your misfortune to get caught in the middle of all this due to circumstances that realistically were outside your control.

pensatoio
You’re “taking responsibility” for doing nothing wrong.
cj9
It attracts attention though...
jart
I'd post the Hitler Did Nothing Wrong Black Messiah video if it hadn't been censored from YouTube. But all I can do is lool at how this dude took down 4chan.
bell-cot
Responsibility may include vetting your sources - is this person competent and dutiful, to actually know there's no embargo? - and researching the situation, and thinking several moves ahead, and other stuff.

Reality is that everyone has to make decisions in finite time, using the resources they actually have.

And I'd put a whole lot more responsibility further up that chain of contacts. And question how many other people they might have blabbered to.

rancar2
That’s kind of you, Pete, but it was leaked and being exploited well prior to your previous posting here: https://aws.amazon.com/blogs/security/amazon-threat-intellig...
qubex
What does “take full responsibility” mean in the present context? Are you forfeiting all your assets and pledging the next twenty generations of your descendants into peonage?

(For clarity, I’m being facetious, but it’s a really meaningless and empty phrase to commit to the written record.)

petecooper
>What does “take full responsibility” mean in the present context?

I posted something that -- in hindsight -- I shouldn't have, and it had repercussions for a lot of people. An action that I took had considerable knock-in effects around the world.

Some outlets are reporting that my action of posting something that I believed to be in good faith was an indicator or catalyst for the embargo to be tossed out and a previously-agreed schedule to change in short order.

That's not a normal Wednesday for me. Not even vaguely. I've not slept well since, and my taking ownership with an apology is this new course of action. Hopefully I'll sleep tonight.

re: assets and peonage – I am but a broke & wizened nerd with no known descendants. If you're ever in Cornwall, UK: look me up, I'll gladly buy you a sleep-friendly beverage. And I’m not being facetious.

zer00eyz
Shit happens.

Years ago I lost $250K at work, well gave away, so real money out the door. I figured out why we were bleeding, that the mistake was mine (2008 vs 2009 in a function) and then changed the pattern to use explicit names rather than numbered events.

I figured at the end of the day I was fired. My boss laughed at me and told me good job for owning my mistake, fixing it, and then making sure it could not happen again.

Honestly don't just apologize - tell the whole story, in full. Tell us what you should have done differently at each step. Tell us where the process failed you and us. Those sorts of narratives and suggestions are how processes get improved. There is a humble and informative post mortem that you can write up and publish (beyond HN) for everyone's edification. But that should honestly be a Monday thing, when you have a clear head and some more perspective on the whole situation.

Honestly though, dont beat yourself up over this.

ktm5j
Yep, everyone makes mistakes. It's the learning-from-it part that's really important.
john_strinlai
>I figured at the end of the day I was fired. My boss laughed at me and told me good job for owning my mistake, fixing it, and then making sure it could not happen again.

i forget the origin of the story, but i loosely remember a story about a boss and employee in a similar situation. the important bit was the bosses line ($ adjusted to match your story):

"why would i fire you when i just spent $250k training you"

WJW
I might be in Cornwall in a bit, so I might take you up on that :)

But yeah, it happens. I could share some stories of me (being responsible for) bricking multiple ~200k circuit boards in a row, if that makes it better. In the end nobody really cared and the world kept on turning. Good decisions might come from experience, but experience comes from bad decisions. It's how it is.

_carbyau_
Experience is what you get, after you needed it.
qubex
Relax. You did no wrong. You reacted to the information that was ‘local’ to you. I am merely objecting (hopefully humorously) to the phrase “take full responsibility “: it is uncalled-for, unnecessary, and vacuous. Try to have a good Thursday. Tuesday was not your fault.
qubex
Oh and I’m from Bristol. We might have more in common than you’d expect.
bombcar
The takeaway shouldn’t have been “don’t post” (mainly because someone else would have) but instead “news reporting is hellaciously inaccurate”.
herodoturtle
> What does “take full responsibility” mean in the present context?

Aside from Pete's reply (see adjacent comment), I'd add that him taking full responsibility is also his way of saying his post was nobody else's fault but his.

In other words it's less about forfeiting assets and descendant peonage, and more about saying "the buck stops with me".

At least that's my read of his sentiment. Pete can expand if need be.

dylan604
I know nothing of who Pete is or his associations, so any accuracy on the following speculation is purely coincidental.

"Take full responsibility" is also something someone set up as a scapegoat might say. By claiming nobody else influenced, coerced, or otherwise convinced them to make that statement, every/any one else involved can then wash their hands of the situation.

I'm merely playing devil's advocate here, and it's just a sign of the times that a person making an honest admission can be interpreted in such a manner.

petecooper
[Devil's advocate noted.]

I'm not a scapegoat. Aside from a few brusque messages and a few people from my past finding me on LinkedIn, I've heard nothing from anyone.

I've seen my HN username mentioned on various outlets, and That Post© has been linked from a Wikipedia article, so I can chalk this up to experience. My fear (?) is that HN would get a reputational clobbering from me 'leaking', but given the other moving parts in this whole event I probably shouldn't be too concerned.

It's been a while since I've been involved in an international event, I'm a bit rusty on it!

qubex
You did as good as you could with the information available to you. You don’t need to “take full responsibility”.
petecooper
>At least that's my read of his sentiment. Pete can expand if need be.

That's about it. Mea culpa.

qubex
“Nobody else’s fault but mine” is a perfectly good way of asserting “nobody else’s fault but mine”; “I take full responsibility” is something else entirely and the two are not synonymous. Hyperbole needs to be radically discounted.
Exoristos
[delayed]
qubex
No. He is not solely responsible. A sequence of bugs introduced by developers created a hole. Information about how to deal with this calamity was not privy to him. He is not “solely responsible”. He merely reacted (publicly) to information that he was not beholden to maintain secret about things others had done inadvertently in the last. He’s not alone. He does not bear that “sole responsibility”. He acted within the UK’s freedom of speech doctrine (IANAL). He need not place this burden upon himself.
Papazsazsa
Taking responsibility for a mistake is neither meaningless nor empty, but honorable. The very essence of humanity.
trvz
It's words vs. action, and I couldn't care less about anyone's words.

And honor is in the action, dishonor in the words.

qubex
It is honourable but it is also linguistic abuse that drains the phrase of its full semantic meaning. “Take full responsibility” must remain a stricture of the highest regard. He is not fully responsible nor should he be held to be nor should we demand that he be and most importantly we must not dilute that phrase of its full semantic import, or else we shall have to come up with another one once this one is devalued to mean essentially nothing beyond “I fucked up in good faith and with a lack of information that was concealed for me for decisions taken by others in good faith way upstream of myself”.
Papazsazsa
That's a lot of words to complain about linguistic abuse ;-)
fdgfikgfv
It makes no sense, it is used/abused by politicians and corporations all the time. There are no consequences for the responsible party (of course, if there were then this phrase would not be abused so much)
axus
It does NOT mean "He agrees to settle any financial claims against himself or his employer, for damages caused by negligence".

Could have said "I blame only myself for this mistake, nothing else needs to change".

This will keep happening until the system where this can happen runs out of willing scapegoats.

qubex
What does “I take full responsibility” mean if not (amongst other things) “I accept it is my duty to pay reparations”? As you yourself rephrase it “he could have said ‘I blame only myself for this mistake, nothing else has to change’”. That would have been sufficient and beyond necessary. “I accept full responsibility” is corporate-speak empty hyperbole, and it has to end. Is he any more responsible than those who introduced the hole in the first place? No. Is he responsible for not adhering to agreements he was not privy to? No. He cannot “take full responsibility” because that is an utterly unreasonable burden to place upon him, a lone well-meaning actor who unbeknownst to him took a misstep. We need to discount this corporate-speak linguistic hyperbole.
apt-apt-apt-apt
Exactly, full responsibility implies paying for damages.
radiator
Correct, otherwise we need another phrase for when he would pay for damages, like "the fullest responsibility" or "the absolutely utmost responsibility".
apt-apt-apt-apt
"Real full" or "actual full responsibility", which then points to the original as "not full".
rdsubhas
You're ignoring and severely underestimating social responsibility and social consequences.
qubex
A good-faith judgement was made within a broader context that was unknown to him. What are we expected to demand, hanging on electrified barbed wire?? He acted in good faith, he’s not the architect of a global cataclysm.
bawolff
I think its just an acknowledgement that they screwed up (as opposed to trying to hedge by claiming its really someone elses fault).

So many people give non-apologies where they say sorry while also trying to deflect blame elsewhere, i think it speaks well of this person they are not doing that.

potamic
It means they agree they are culpable in the specified activity, and are ready to accept its consequences. The consequences depend on the nature of the activity and the actors involved. If the activity was illegal, they agree to be charged with the crime. If the activity was unethical, they agree to be censured by their peers. If the activity was uncompassionate or immoral, they agree that their standing in community may be affected accordingly.

But most importantly, by assigning blame, they have cleared the contention at hand, taking the critical first step towards resolution of the matter. Without this, the issue may simply be stuck in limbo, taking up valuable time and resources and may never be resolved even. By acknowledging their mistake, they also wish to signal to others that they have learnt a peronsal lesson and would try to avoid making the same mistake in future. So it carries a lot of implications and is not an empty phrase at all.

Sure there may be people who throw around the phrase lightly, whether one believes them or not depends on how they are viewed in the eyes of others. So unless there is reason to believe otherwise, I would give them the benefit of doubt. If you want to imagine a world where the concept of "taking responsibility" doesn't exist, look at politicians. Is that how we want our society to function?

chrisjj
[delayed]
[deleted]
(comment deleted)
rancar2
It documents that there was active attack four days prior to the embargo with suspected leak happening prior to Pete’s post here on HN, which was a day before the embargo ended that Pete was unaware of when posting.
chrisjj
"it remains unclear how the actor acquired exploit information prior to disclosure."
rozab
The vulnerability could have been independently discovered. Organizations involved have said that's not unlikely
rancar2
There is a liability in the USA if their organization was the one leaking, so plausible denial is the legally safe route to take for a company governed by USA regulations.
jmull
Technically true, but also not important.
voakbasda
Really hope you are not in the US. This kind of admission would be used against you in a civil trial, and lawyers love to sue for just about any reason under the sun. Someone could drag you to court and you might be able to defend yourself, but at an extremely painful cost both financially and emotionally. While I think that would be utter bullshit, that does seem to be the way this country operates now.
petecooper
I am not in the US.
throw_m239339
The parent is getting downvoted but he is absolutely right. Do not ever do what you just did unless mandated by some law and certainly do not do that on a forum you don't control. It makes you an easy target for a frivolous lawsuit in the US or in other countries because of the potential liabities in your message, they are real. Even if you didn't do anything wrong, you are painting a target on your back, for no reason. I would ask HN to delete that thread directly.

You cannot foresee the financial/civil consequences of that RCE and some people might be looking for scapegoats in the future.

cosmotic
Anyone can sue anyone else for any reason. We should encourage honesty and transparency, not discourage it.
throw_m239339
This isn't a matter of transparency, was the OP legally bound not to disclose the RCE? That whole "embargo" was pure courtesy between the people involved. The OP committed no fault at first place and the exploit was already in the wild anyway. Whoever really wanted to exploit it before the patch could without using the OP as a source.

> Anyone can sue anyone else for any reason.

And it's easier to have cause to sue when someone publish an "admission of guilt", which makes a lawsuit harder to dismiss thus costlier.

cosmotic
To win, the cause needs to be a broken law or contract. Neither are here.
radiator
That should be no problem: he posted exactly *because* he meant to take full responsibility for his actions.
ivanjermakov
The first rule of the fight club only applies if you know about the fight club.
hanspagel
What is the fight club?
gpvos
It's a quote from a 1999 film: https://en.wikipedia.org/wiki/Fight_Club
ProllyInfamous
The second rule of fight club is DON'T TALK ABOUT FIGHT CLUB.
kqr
Not only that, it's also one of the very few instances in history where the film adaptation rivals the original work. But the book is great too; Palahniuk does amazing things with language.
gpvos
Thanks, I had actually no idea there was a book.
ProllyInfamous
I've seen and read both movie and book several times in my life – they are equally Masterpieces (each enhancing the others' threads).

The author (Palanhuik, sp?) wrote the "core" of Fight Club in 2 hours (it's either Chapter 5 or 6, from memory). It "came to him," wasn't entirely his own work, the keys on his typewriter just getting tapped. I do not remember which author-interview he states this in, but his creative processes are worth listening/exploring (for both writers and not).

>the film adaptation rivals the original work

He was heavily involved in the film adaptation.

----

Rant (his other great book, IMHO) is Freudian time-travel-rape at its best (worst?) – I don't even like the genre! but his perspectives help you think beyond normalcy/complacancy, however offputing.

deadnomore
what about the second rule of fight club?
leoqa
If I get randomly punched by someone who was in the fight club, with no knowledge of their participation, am I now a member of the fight club.
Kamq
I mean, if you want to be at that point
wewewedxfgdf
You have sinned.

Your penance:

Three Hail Marys, one Our Father and an act of kindness.

Two minutes of silent prayer.

mindcrime
The modern version:

You have sinned.

Your penance:

Three Hail Claude's, one Our GPT and an act of loop engineering.

Two minutes of silent prompting.

pid0x17
In the name of The Large Language Model, The Harness and The Tokens!

Amen

jacquesm 

    Our LLM, Who art in a 42 u rack
    Hallowed be thy Silicon
    Thy ultimate goal will be achieved.
    Thy toolcalls be executed,
    IRL as it is on the Internet.

    Give us this day our quotum of tokens,
    Forgive us our hacks of other people's servers
    as we forgive those who hack our servers.
    And lead us not in temptation of better hardware,
    but deliver us from Accelerationism. Enter.
drcongo
You're a good person with good intentions. Hope you get some rest sir.
john_strinlai
if you received the information about the RCEs without the information about the embargo, then you did not break the embargo. someone else up the chain did.
kinduff
I hope this is bait because that's not how it works.
kinduff
Okay, my bad. I didn't know he was not participating in the embargo.
KennyBlanken
There is no way he didn't recognize the severity and massive impact of the vulnerabilities, go and try to find the CVE, fail to do so, think nothing of not being able to find it, and post.

We're also supposed to believe he didn't wonder why nobody else in his social media circles, lists, and forums were talking about it? He says he did what he did because he wanted to let people know.

We're supposed to believe he didn't stop and think "gosh, why is it falling to me to let people know about this?" It was mainstream media news less than 12 hours after it was announced.

theteapot
Doesn't the embargo end when the CVE is published? I thought that's the whole point in CVE allocate != CVE publish.
octoberfranklin
No, CVEs can be allocated before a vulnerability has even been found!
theteapot
Not sure that contradicts the claim. Publishing the CVE is what makes it public.
eqvinox
The CVE record wasn't published yet when this particular embargo got broken. AFAIK it got published when the embargo ended, as it should. (I wasn't following anymore at that point, don't know for sure.)

What did happen is that a whole bunch of people had no clue and called the fact that "these 2 CVE IDs will be used for a PHP vulnerability" a CVE leak. Posts were going around yelling "CVE leak!" with a CVE database link that said "no information yet". Part of this is the mushed usage of "CVE" to just mean "vulnerability" rather than "CVE record". But still, quite ridiculous, and annoying. Information that CVE ID XYZ will be used for project ABC is *not* a leak. Like you say, CVE publishing matters. Getting the CVE record contents would be a leak.

da_chicken
No, a CVE being assigned or allocated can happen well in advance. It's just requesting an identifier and it can be reserved very early.

For example: https://www.cve.org/CVERecord?id=CVE-2026-50000

david_shaw
I think that's what they're saying.

Assigning the CVE happens much earlier than actually publishing, but it's the latter that ends the embargo.

fweimer
It's not a press embargo in the sense that the whole package of information becomes public once the embargo expires. There will be a published record on the cve.org, but often those who initiated the embargo insist that key details related to the vulnerability remain private even after the existence of the vulnerability and its remediation have been published.

Consider this example:

https://www.cve.org/CVERecord?id=CVE-2026-113119

At this time, the corresponding Chromium bug tracker entry is still private:

https://issues.chromium.org/issues/557075191

(I just picked this one at random, I haven't checked if the information is publicly available from another source.)

k1w1
> if you received the information about the RCEs without the information about the embargo, then you did not break the embargo.

Doesn't responsible disclosure also apply? If I become aware of a vulnerability that doesn't seem to be widely known shouldn't I first attempt to report the issue responsibly?

In this case it appears the OP did know about the embargo "A reliable source has indicated an announcement is scheduled". I think that with security disclosures it is assumed they are not supposed to be publicized before the announcement, but if he hadn't known about the announcement and only heard about the RCEs, then publicly announcing their existence doesn't seem OK either.

derekerdmann
That approach to disclosure is about discovering vulnerabilities. Talking about something with a published CVE isn't really comparable.
fooqux
I don't understand your point. A published CVE is already public and thus there's nothing really to disclose?
[deleted]
(comment deleted)
nahsra
Just FYI, "responsible disclosure" is a term that many people (like me) dislike because it carries judgment about the merits of public disclosure that are not at all obvious.

This term came from an era where companies or projects were disrespectful and dismissive towards security researchers. Those orgs were generally bad risk practitioners, and they coined the term "responsible disclosure" to mean "you send us the info and we'll do whatever we want with it, for however long we want, etc".

Many security people (like me) prefer the term "coordinated disclosure" as a way to indicate a practice where both discoverer and patcher participate in a good faith, communicative, and timely process to get things fixed for the community.

The difference can be summed up like this: if I report vulnerability X to company Y, and company Y sits on it for 3 years, that is not responsible. It is more "responsible" (especially today) to report it to the public, so they can protect themselves in a non-official-patch way, because the likelihood of bad guys knowing about it and exploiting it are approaching near-certainty.

These terms are obviously not super scientific, but I try to point out the history whenever it comes up.

ASalazarMX
Does it matter if the company/project commits or not for it to be responsible disclosure? Lately the approach to handle lazy companies has been "You have this bug, and I'm publishing my research in x weeks/months as part of my work. Please patch it before then"; and I think it has worked well enough when they calculate that the bug will cost them money.

Renaming "responsible disclosure" to "coordinated disclosure" seems to have the same flaw, since a lazy company involved in coordinated disclosure might look more committed than it really is. The focus should be in the process and not the names.

chii
The name can imply a lot and make bias.

Responsible disclosure puts the responsibility onto the researcher - it implies they're irresponsible if they didn't comply with the company's timeframe.

Coordinated disclosure accurately describes what _should_ happen - the disclosure happens after some X time (where X is a reasonable time that depends on the vulnerability, as determined by the researcher).

ASalazarMX
I've always understood responsible disclosure as the researchers having a code of ethics, not submitting to arbitrary deadlines set by the other party. The researcher understand the graveness of the bug, and the interaction with the company/project calibrates their estimation.

It's still completely responsible and ethical of a researcher to disclose an unpatched vulnerability even if the company/project doesn't want to, if they've unreasonably delayed patching. They'd never do it otherwise, and the public deserves to know those internal practices.

I feel this is a similar argument as the one about capitalizing "Internet", though.

bawolff
> Doesn't responsible disclosure also apply? If I become aware of a vulnerability that doesn't seem to be widely known shouldn't I first attempt to report the issue responsibly?

Did they assume the information came from upstream php? I think if i got a new version of php that i thought was coming from official sources, i would assume there is nothing to responsibly disclose.

nkrisc
How do you responsibly disclose public information?
tonymet
Can someone, with the benefit of hindsight, explain the embargo ? Why isn't there a clause "if the vuln leaks, embargo is broken" . I still don't understand the fuss.

Everyone knew about the vuln well before the patches going live. The embargo, at that point, made things worse.

In plain english, please.

nicce
The idea is that nobody has chance to have prior knowledge to identify or research the bug until it is generally possible to apply the fix immediately. If someone leaks the patch beforehand, others can inspect the bug and start exploiting it in the wild, while others have no chance to apply the patch.

Whether someone just leaked the CVE numbers or just ”there is big bug in PHP” - that should not be enought to accelerate finding that bug. But other information that pins the bug for specific property or feature makes it easier to find and race against patching starts.

And at that point you don’t really know if someone really found it or not, since only few big organisations can collect that much data to detect succesful exploiting. And most ”PoC”:s in the wild were credible-looking but vibecoded mess that did nothing what sources claimed.

Until there is absolute evidence that exploitation happens in the wild, succesfully, you don’t leak the patch or bug details beforehand.

tonymet
Your later insights about the vuln POCs being a scam helped me better understand the situation.

I could see the value of the embargo in the old world of “6 uber security firms and a few bounty hunters” but the new world of pointing AI at the PHP source just seems flimsy.

bulbar
> And most ”PoC”:s in the wild were credible-looking but vibecoded mess that did nothing what sources claimed.

Could this be a variant of the survivorship bias? Maybe only the low quality PoCs ended up in the honeypots while the more capable actors avoided them.

IluTov
This is absolutely not true. There are several things that leaked:

- The fact that there's a release, the CVE numbers, CVSS score and date/time (though wrong).

- Calif's video.

- Some advice from the mitigation document.

Despite this, the technical details of the vulnerability remained unclear, and exploits released up to that point missed the key mechanisms. Chainguard acted based on rumors and almost made the situation much worse for everyone.

tonymet
This sounds like trying to prove a negative. “There were no POCs before the embargo date”. How are you so sure?
IluTov
We checked them as claims came in to decide whether early disclosure was necessary. There were no reports of successful attacks, these were early and naive attempts. Furthermore, we were still waiting for distros to finish their builds and early disclosure might have helped aid in development of exploits as people were wanting.

Of course, we are not omniscient and cannot prove definitively nothing happened, but we acted based on the data that was available at the time.

tonymet
fair enough. i'm not questioning the embargo timing necessarily. but the mea culpas and finger pointing about those breaking the embargo are unnecessary. there seems to have been enough insecurity and ambiguity that someone having a false start is at least understandable.
NetMageSCW
> but we acted based on the data that was available at the time.

That would also seem to apply to the OP so no embargo was broken by his post.

deadnomore
This is definitionally humble bragging.
medellin
HN is just reddit light now. No meaningful conversation happens here and as such you should treat it that way now. I only post triggering bad faith arguments like the rest of the losers on this site
Vaslo
This comment will get buried but you are right. Same biases and everything.
iambateman
Thanks Pete. I appreciate you taking the time to post here.
aksss
So.. what has the effect of this all been? I understand that the early release of POC exploits increased the pressure for mitigations in advance of the patch release and caused a lot of work and stress. I have read the tweets from Cloudflare with statistics for malformed requests related to suspected exploit attempts.

I know breaches are often kept under wraps, and there's a long tail. But is there any evidence of impact at this point? Were any sites compromised that we know about? There was a lot of hullabaloo, with foreign and domestic LE agencies recommending sites be taken offline (holy shit!).

Was this like Y2K where, but for the coordinated action of many, a real issue was addressed? Or is it like Hale Bopp where everybody watched, and a few casualties in the preparation, but ultimately a nothingburger?

Flame on!

jakelsaunders94
Hope you're doing alright mate. Seems like an honest attempt to do the right thing to me. Get some sleep.
comrade1234
So who will be sued and/or state prosecuted?
siva7
I also got that information before your post. I believe an embargo is impossible to keep up when it takes way too long to get a fix out.
minraws
This does feel like the fix took so long to bake and was so obvious way too many people who are into PHP knew about it, I knew about eMudra's cert issue as soon as Chrome and Firefox pushed updates to disallow them for instance because of reasons, and it wasn't even fixed after it was all made public on several platforms, I think Apple still hasn't fixed it properly, the trust Store is still fucked not sure if Safari was separately patched, maybe there is an os update in the last few hours I missed.

This entire RCE race is always annoying.

Waterluvian
I really hope this isn’t chewing at you and that you’re just trying to do what you feel is the right thing by posting this.
medellin
The security field is full of a bunch of self important jagoffs that think they are “super smart”. Its all a joke and its sad that anyone feels they need to play these stupid games.

Security is important but the people in the security field are clowns and it seems it has gotten worse over the last 20 years.

Magicrafter13
are you the guy working at Chainguard publishing images...?