Hacker News Contributor Admits Early Leak of Critical PHP Flaws

A prominent voice on the Hacker News forum has issued a public apology for revealing sensitive details about two critical PHP security flaws before the official embargo lifted. The user, who operates under the handle petecooper, stated that they were unaware a strict disclosure restriction existed when they posted the information online.

In their explanation, petecooper described themselves as a self-employed consultant and the sole founder of a mental health non-profit organization. They claimed to have no formal ties to the security teams involved. The primary motive for the early post was to alert other developers who track the PHP four-week release cycle that the issues were urgent. The user specifically referenced the remote code execution vulnerabilities identified as CVE-2026-109618 and CVE-2026-109619. They accepted full responsibility for the disruption, noting that the premature release created additional workload for the coordinating teams.

The PHP Foundation had intended a controlled announcement to allow time for patches to be applied before the flaws became public knowledge. However, the embargo was not consistently communicated. Petecooper noted that their contact indicated no embargo existed, a claim that contact’s own source had also made. This breakdown in communication contributed to the early leak. Both vulnerabilities carry a severity rating of 9.2, indicating high risk for systems that fail to patch promptly.

Petecooper was not the sole source of the early information. Other leaks had already circulated on social media and various platforms, forcing the foundation to move its announcement forward by one day. The organization also pointed out that security firm Chainguard broke the embargo by more than six hours. Dan Lorenc, the co-founder and CEO of Chainguard, defended his company’s actions on LinkedIn. He explained that after consulting with other researchers, he chose to notify the broader community once the fix was public, rather than limiting the alert to customers.

The two bugs reside within the PHP runtime itself and were discovered using artificial intelligence tools. They were not caused by rogue AI systems. The use of such tools highlights a growing trend where both security experts and malicious actors can uncover long-standing vulnerabilities in widely used code. This dynamic turns every discovery into a race to deploy fixes before the flaws are exploited.

The incident underscores the challenges of coordinated disclosure in the modern tech landscape. As AI tools become more common in security research, the window between discovery and public knowledge continues to shrink. For working families and small businesses relying on web applications, the rapid pace of these updates demands constant vigilance to ensure their digital infrastructure remains secure against emerging threats.