Consultant apologizes for early disclosure of critical PHP flaws
Consultant petecooper apologized for posting about CVE-2026-109618 and CVE-2026-109619 before an embargo ended, saying they did not know an embargo existed and had wanted to warn followers about PHP's four-week release cycle. The report says multiple leaks circulated, the PHP Foundation moved its announcement forward by one day, and Chainguard also disclosed a fix more than six hours early. It describes both vulnerabilities as affecting the PHP runtime, having been discovered using AI tools, and carrying critical severity scores of 9.2. The precise sequence of the disclosures remains unclear, and the report does not establish that petecooper's post directly caused the PHP Foundation to change its announcement schedule.
The PHP Foundation had planned a controlled public release so affected websites and applications could be patched before the vulnerabilities became widely known. Multiple early disclosures affected that coordinated-disclosure schedule, highlighting the difficulty of coordinating embargoes among recipients and security vendors.
A Hacker News user who shared news about the recent PHP vulnerabilities revealed by ChatGPT Sol before an embargo, which they claimed to be unaware of, has taken to the platform to apologize for the post. According to petecooper, they shared the CVEs because they wanted to alert others who follow the four-week PHP release cycle about the importance and urgency of the matter, but they weren’t aware of the news blackout that went with the two identified vulnerabilities.
The user said they have "No connection or affiliation to any of the organisations involved." Noting, "I am a self-employed consultant for my day job, and a solo founder of a mental health non-profit on the side." Petecooper's original post about the vulnerability was among the first to break the NDA, though they claim they were unaware.
“I posted here about the then-upcoming PHP RCEs related to CVE-2026-109618 & CVE-2026-109619. I appreciate this has had considerable knock-on effects with the schedule for co-ordinated disclosure, and created additional workload. I am truly sorry. I take full responsibility for my actions,” petecooper wrote on the platform. “It was not remotely my intention to cause any of the subsequent side effects. At the time of posting, I didn’t know about any embargo. My contact had told me there was no embargo, and her contact had told her the same thing.”
#PHP Foundation#PHP#Chainguard#ChatGPT Sol#CVE-2026-109618#CVE-2026-109619