Devastated forum user who accidentally broke the PHP news embargo comes clean

A forum user who disclosed two critical PHP vulnerabilities before a coordinated release says he was never told an embargo existed. The user, petecooper, wrote on the platform that the episode had significant knock-on effects on the coordinated disclosure schedule and added to the workload of those involved. He apologized and accepted full responsibility for his actions. He also stated that he had no connection or affiliation to any of the organizations involved.

Petecooper described himself as a self-employed consultant in his day job and a solo founder of a mental health non-profit on the side. In his post, he said he wrote about the then-upcoming PHP remote code execution issues tracked as CVE-2026-109618 and CVE-2026-109619. His post was among the first to break the non-disclosure agreement, according to the source reporting, though he claims he was unaware of it at the time. He said the contact who told him about the flaw had said there was no embargo, and that her own contact had told her the same.

The two vulnerabilities are both rated critical and both scored at 9.2. The PHP Foundation had planned a controlled public release so that affected websites and applications could be patched before the flaws became widely known. Some recipients of the warning did not pass along the embargo that came with the CVEs, and the news spread earlier than planned.

Petecooper was apparently not the only early leaker. Several leaks were already circulating on social media and other platforms, which pushed the PHP Foundation to move its announcement up by one day. The organization also said Chainguard broke the embargo by more than six hours. Dan Lorenc, co-founder and CEO of Chainguard, defended the decision on LinkedIn. He said he made the call after speaking with several other researchers and notified the group immediately after releasing the fix publicly, and not only to his own customers.

The bugs in the PHP runtime itself were found with AI tools, not through attacks by rogue AI. Even so, the capabilities of the technology could make it easier for both security researchers and malicious actors to uncover vulnerabilities that may have sat unnoticed in widely used code for years or even decades. That dynamic turns disclosure into a race to find and deploy a fix before the flaws can be exploited.

More cybersecurity news from TechManNews.