Tell HN: I unknowingly broke the PHP RCE embargo. I am sorry

	Tell HN: I unknowingly broke the PHP RCE embargo. I am sorry
	733 points by petecooper 3 days ago \| 264 comments
	tl;dr: The author publicly posted about upcoming PHP RCE vulnerabilities (CVE-2026-109618 & CVE-2026-109619), unknowingly breaking the coordinated disclosure embargo and disrupting the release schedule. They claim their contact had assured them no embargo existed, and their intent was simply to alert fellow source-compilers about the urgency of the upcoming updates. They are apologizing and taking responsibility for the unintended consequences.
	HN Discussion: ↓You cannot break an embargo you were never informed about or party to ↓The failure lies upstream in the disclosure chain, not with the author ↓Taking blame obscures the real process failure and harms blameless post-mortem culture ~The phrase 'take full responsibility' is meaningless without concrete consequences ↓The vulnerability was already leaked and exploited before the author's post anyway