A researcher publicly posted about upcoming PHP RCEs (CVE-2026-109618 & CVE-2026-109619) without realizing an embargo was in place, disrupting coordinated disclosure schedules and creating additional workload for the security community. The author takes full responsibility, stating they were misinformed by contacts who claimed no embargo existed, and apologized for the unintended consequences.
Background
Security vulnerability embargo is a practice where researchers agree to keep details of a vulnerability private until a coordinated disclosure date, allowing vendors time to prepare patches.
- Source
- Hacker News (RSS)
- Published
- Oct 22, 2026 at 06:11 PM
- Score
- 7.0 / 10