The Hacker News author who first publicized a PHP remote code execution vulnerability apologized for disrupting coordinated disclosure. In the original post, the author said a contact had told him there was no embargo, and that he intended to alert people building from source to the importance of updating, while accepting responsibility for the outcome. The PHP Foundation’s account says CVE identifiers, an incorrect score and the planned time circulated early, prompting an earlier announcement, and notes that distributions also needed time for packaging. The individual’s account has not been independently established. This follow-up concerns disclosure coordination, rather than the already released fix.
Back to Tech
Tech
Author apologizes for early PHP disclosure and explains coordination failure
The follow-up highlights responsibility for confirming an embargo and communicating the disclosure schedule, separately from the patch itself.
Sources
- Tell HN: I unknowingly broke the PHP RCE embargo. I am sorry.
- Tell HN: I unknowingly broke the PHP RCE embargo. I am sorry. (HN API original)
- Tell HN: 저도 모르게 PHP RCE 엠바고를 어겼습니다. 죄송합니다.
- Today's PHP Security Release, and How We're Strengthening PHP Security — The PHP Foundation — Supporting, Advancing, and Developing the PHP Language