Tell HN: I unknowingly broke the PHP RCE embargo. I am sorry

734 points by petecooper 2 days ago

I posted here about the then-upcoming PHP RCEs related to CVE-2026-109618 & CVE-2026-109619. I appreciate this has had considerable knock-on effects with the schedule for co-ordinated disclosure, and created additional workload.

I am truly sorry. I take full responsibility for my actions.

It was not remotely my intention to cause any of the subsequent side effects.

At the time of posting, I didn't know about any embargo. My contact had told me there was no embargo, and her contact had told her the same thing.

As someone who follows the 4-weekly PHP release cycle and compiles it from source, my intention was to alert others in a similar position to be aware of the importance/urgency of the updates.

That clearly backfired in a pretty wild fashion. I have learned my lesson.

creatonez 2 days ago
> At the time of posting, I didn't know about any embargo. My contact had told me there was no embargo, and her contact had told her the same thing.
If you're not a party to an embargo, and no one told you an embargo even exists... you should not follow the embargo. In fact, you should maybe even consider leaking basic details or challenging the embargo if you are in this situation. In your situation, they had lost information asymmetry before the news got to you. I don't know where people got the idea that unrelated third parties have to follow embargos.
Embargos are not about keeping secrets, they are about the game theory of coordinated disclosure.
- tchalla 2 days ago
  On one hand you have the OP, who is self reflecting. On the other hand you have Dan Lorenc from Chainguard.
  - KingMob 1 day ago
    The thing is, his reasoning isn't even wrong (assuming what he said about the spread of PoCs and the ease of finding the vuln was true), but it clearly prioritized Chainguard customers over the broader ecosystem.
    dreambigwrkhard 1 day ago
    It was a selfish, PR exercise. He could have done it quietly. He could have just made sure his customers got an emergency patch quietly. (those who are willing and capable to patch) It is not common that anyone in the public could use his source except for his customers. It is difficult to just build from his source and drop it to any operating system and setup and expect it to work (let alone compliance and other requirements). Instead, he expected the public to thank him like he was actually doing an act of good. Loss for words, to be honest.
    throwaway7356 1 day ago
    > He could have just made sure his customers got an emergency patch quietly.
    I prefer them going public over breaking the embargo as silently breaking embargos and publishing details about vulnerabilities to an uncontrollably large group of unvetted people is worse.
    throwaway7356 1 day ago
    > but it clearly prioritized Chainguard customers over the broader ecosystem.
    I hope the broader ecosystem responds by putting their customers over Chainguard. The Chainguard customers can then get security updates after the embargo was lifted and Chainguard noticed.
    jasonlotito 1 day ago
    The important thing here is that we know Chainguard's word cannot be trusted.
    Chainguard will lie and cheat to put themselves first. Not their customers, but themselves. These are just plain facts.
    You can't agree to an embargo and then just ignore it when you feel like it. What other things are you willing to go back on your word for, especially when you know for a fact you are putting people in danger.
    r_lee 1 day ago
    it was easy to find if you had the tokens even without the chainguard patch
    hparadiz 1 day ago
    The bragging by the discoverer made everyone start looking. Then when the PHP foundation made the announcement on the website there was a mad scramble. Up to 18 hours before release there were already demos. Look I get that it's a rock and a hard place but frankly at that point you should release the patch. I know there was a lot of fear over picking the wrong patch but having nothing is still bad.
    r_lee 1 day ago
    and like I said in my other comment here, they could've released an OOM-only fix that would've not revealed the actual full exploit but would've protected everyone, but they decided that the only way would be to fix the whole thing and release that... it's very stupid, but seems like it's expected from them, considering it took them 2 months to get to a fix
  - mikestorrent 2 days ago
    got a link
    chillax 2 days ago
    https://www.linkedin.com/feed/update/urn:li:activity:7518756...
- apaprocki 2 days ago
  Yeah, I don’t think OP did anything wrong. Someone in the chain violated embargo, but it wasn’t OP.
- adastra22 2 days ago
  Well, this is an iterated prisoner’s dilemma.
  - deadbabe 2 days ago
    I’d say maybe it’s more like a Roko’s Basilisk. He knew the potential existence of an embargo, but didn’t do anything to protect the embargo. So now that the embargo turned out to be real, he will be punished. Otherwise if he truly did not know an embargo could even exist, he could not be blamed.
    syrrim 2 days ago
    There was no embargo. If there's an "embargo" but parties not subject to the embargo know about it... there's no embargo.
    camgunz 1 day ago
    There's no such thing as Roko's Basilisk, only Pascal's Wager.
    adastra22 2 days ago
    Except he won’t be punished, because nothing he did was legally wrong.
    Calazon 2 days ago
    He won't be punished by the legal system.
    deadbabe 2 days ago
    In the tech industry, there are punishments far worse than the legal system.
    plemer 2 days ago
    Would you please identify those you're thinking of?
    lexicality 1 day ago
    on the darkweb you can pay people to break into wrongdoers houses and set their default browser to Edge. For extreme cases you can also have their TV connected to the internet and all EULAs accepted...
    ben_w 1 day ago
    They might even force you to use PHP :P
    djriley 2 days ago
    People talk.
    nkrisc 1 day ago
    That is truly more frightening than a federal maximum security prison in the United States.
    maxrev17 1 day ago
    Nerd police!!!
    tosti 1 day ago
    Which is completely counter-productive.
- froh 1 day ago
  isn't "coordinated disclosure" exactly about keeping, embargoing, a secret?
  - throawayonthe 1 day ago
    yes but if it reached you without an embargo it's kinda already not kept
    and you weren't coordinated with
john_strinlai 2 days ago
if you received the information about the RCEs without the information about the embargo, then you did not break the embargo. someone else up the chain did.
this whole saga will be analyzed and we'll all come out better for it at the end.
- k1w1 2 days ago
  > if you received the information about the RCEs without the information about the embargo, then you did not break the embargo.
  Doesn't responsible disclosure also apply? If I become aware of a vulnerability that doesn't seem to be widely known shouldn't I first attempt to report the issue responsibly?
  In this case it appears the OP did know about the embargo "A reliable source has indicated an announcement is scheduled". I think that with security disclosures it is assumed they are not supposed to be publicized before the announcement, but if he hadn't known about the announcement and only heard about the RCEs, then publicly announcing their existence doesn't seem OK either.
  - nahsra 2 days ago
    Just FYI, "responsible disclosure" is a term that many people (like me) dislike because it carries judgment about the merits of public disclosure that are not at all obvious.
    This term came from an era where companies or projects were disrespectful and dismissive towards security researchers. Those orgs were generally bad risk practitioners, and they coined the term "responsible disclosure" to mean "you send us the info and we'll do whatever we want with it, for however long we want, etc".
    Many security people (like me) prefer the term "coordinated disclosure" as a way to indicate a practice where both discoverer and patcher participate in a good faith, communicative, and timely process to get things fixed for the community.
    The difference can be summed up like this: if I report vulnerability X to company Y, and company Y sits on it for 3 years, that is not responsible. It is more "responsible" (especially today) to report it to the public, so they can protect themselves in a non-official-patch way, because the likelihood of bad guys knowing about it and exploiting it are approaching near-certainty.
    These terms are obviously not super scientific, but I try to point out the history whenever it comes up.
    ASalazarMX 1 day ago
    Does it matter if the company/project commits or not for it to be responsible disclosure? Lately the approach to handle lazy companies has been "You have this bug, and I'm publishing my research in x weeks/months as part of my work. Please patch it before then"; and I think it has worked well enough when they calculate that the bug will cost them money.
    Renaming "responsible disclosure" to "coordinated disclosure" seems to have the same flaw, since a lazy company involved in coordinated disclosure might look more committed than it really is. The focus should be in the process and not the names.
    chii 19 hours ago
    The name can imply a lot and make bias.
    Responsible disclosure puts the responsibility onto the researcher - it implies they're irresponsible if they didn't comply with the company's timeframe.
    Coordinated disclosure accurately describes what _should_ happen - the disclosure happens after some X time (where X is a reasonable time that depends on the vulnerability, as determined by the researcher).
    ASalazarMX 12 hours ago
    I've always understood responsible disclosure as the researchers having a code of ethics, not submitting to arbitrary deadlines set by the other party. The researcher understand the graveness of the bug, and the interaction with the company/project calibrates their estimation.
    It's still completely responsible and ethical of a researcher to disclose an unpatched vulnerability even if the company/project doesn't want to, if they've unreasonably delayed patching. They'd never do it otherwise, and the public deserves to know those internal practices.
    I feel this is a similar argument as the one about capitalizing "Internet", though.
  - derekerdmann 2 days ago
    That approach to disclosure is about discovering vulnerabilities. Talking about something with a published CVE isn't really comparable.
    fooqux 2 days ago
    I don't understand your point. A published CVE is already public and thus there's nothing really to disclose?
  - bawolff 2 days ago
    > Doesn't responsible disclosure also apply? If I become aware of a vulnerability that doesn't seem to be widely known shouldn't I first attempt to report the issue responsibly?
    Did they assume the information came from upstream php? I think if i got a new version of php that i thought was coming from official sources, i would assume there is nothing to responsibly disclose.

Showing 38 of 265 comments. Full thread on Hacker News.