Petecooper Apologizes For Posting PHP Fixes Ahead Of Embargo

A Hacker News user named petecooper apologized this week for publishing details of two critical PHP vulnerabilities before a planned disclosure embargo expired.

Petecooper said they posted the CVE identifiers to warn developers who track PHP's four-week release cycle that the issue required urgent attention. They described themselves as a self-employed consultant and the solo founder of a mental health non-profit, and said they have no affiliation with the organizations involved in the disclosure. "I appreciate this has had considerable knock-on effects with the schedule for co-ordinated disclosure, and created additional workload. I am truly sorry. I take full responsibility for my actions," they wrote. They added that their contact had told them no embargo applied, and that the contact's own source said the same.

The flaws, CVE-2026-109618 and CVE-2026-109619, are rated 9.2 in severity. Both are bugs in the PHP runtime itself. The PHP Foundation had arranged a controlled release so websites and applications could install patches before the details circulated widely.

Advance warning materials reached recipients who did not pass along the embargo terms, and details surfaced on social media and other platforms ahead of schedule. Several leaks appeared before petecooper's post. Chainguard also broke the embargo by more than six hours, according to the PHP Foundation. Dan Lorenc, co-founder and CEO of Chainguard, wrote on LinkedIn that he acted after speaking with several other researchers and that he notified the group once the fix became public.

The PHP Foundation moved its announcement forward by one day in response. The vulnerabilities were found using AI tools rather than through attacks by rogue AI. Such tools can surface flaws that have sat in widely used code for years or decades, which puts researchers and attackers in a race to deploy a fix first.

The PHP Foundation's revised disclosure schedule took effect October 23, 2026.