顾问就提前披露PHP关键漏洞道歉
顾问petecooper为在禁发期结束前发布CVE-2026-109618和CVE-2026-109619相关内容道歉,称自己当时不知道存在禁发安排,原本是想就PHP四周一次的发布周期向关注者发出警告。报道称,当时已有多起信息泄露,PHP Foundation将公告提前一天,Chainguard也提前六个多小时公开了修复。报道将两项漏洞描述为影响PHP运行时、由AI工具发现,关键严重程度评分均为9.2。多次提前披露的具体先后顺序仍不清楚,报道也没有认定petecooper的帖子直接导致PHP Foundation调整公告时间。
PHP Foundation原计划通过受控公开发布,让受影响的网站和应用程序能够在漏洞广为人知前完成修补。多起提前披露影响了这一协同披露安排,也凸显了参与者在接收漏洞信息后协调禁发安排以及与安全厂商协作的困难。
A Hacker News user who shared news about the recent PHP vulnerabilities revealed by ChatGPT Sol before an embargo, which they claimed to be unaware of, has taken to the platform to apologize for the post. According to petecooper, they shared the CVEs because they wanted to alert others who follow the four-week PHP release cycle about the importance and urgency of the matter, but they weren’t aware of the news blackout that went with the two identified vulnerabilities.
The user said they have "No connection or affiliation to any of the organisations involved." Noting, "I am a self-employed consultant for my day job, and a solo founder of a mental health non-profit on the side." Petecooper's original post about the vulnerability was among the first to break the NDA, though they claim they were unaware.
“I posted here about the then-upcoming PHP RCEs related to CVE-2026-109618 & CVE-2026-109619. I appreciate this has had considerable knock-on effects with the schedule for co-ordinated disclosure, and created additional workload. I am truly sorry. I take full responsibility for my actions,” petecooper wrote on the platform. “It was not remotely my intention to cause any of the subsequent side effects. At the time of posting, I didn’t know about any embargo. My contact had told me there was no embargo, and her contact had told her the same thing.”
#PHP Foundation#PHP#Chainguard#ChatGPT Sol#CVE-2026-109618#CVE-2026-109619