PHP RCE Embargo Broken
- Investigating(current)
- Trending(upcoming)
- Workaround available(upcoming)
- Resolved(upcoming)
Executive summary
A user unknowingly broke the PHP Remote Code Execution (RCE) embargo, causing significant side effects and additional workload. The user takes full responsibility for their actions.
No verified workaround yet
None of the linked reports describe a mitigation. Follow this incident to hear when one appears.
Under active investigation. No report has identified a root cause yet.
Evidence
1 report · 1 HNShow
- [1]HN First reportTell HN: I unknowingly broke the PHP RCE embargo. I am sorry(opens Hacker News thread in a new tab)
I posted here about the then-upcoming PHP RCEs related to CVE-2026-109618 & CVE-2026-109619. I appreciate this has had considerable knock-on effects with the schedule for co-ordinated disclosure, and created additional workload. I am truly sorry. I take full responsibility for my actions. It was not remotely my intention to cause any of the subsequent side effects. At the time of posting, I didn't know about any embargo. My contact had told me there was no embargo, and her contact had told her…
by petecooper 753upvotes 270comments
Timeline
- First report on Hacker News thread
Tell HN: I unknowingly broke the PHP RCE embargo. I am sorry
Source