Petecooper Apologizes After Early Post of Critical PHP Flaws

A user on the popular developer forum Hacker News has issued a public apology for sharing details of two critical security flaws in PHP before the official embargo period ended. The post, which revealed specific vulnerability identifiers, effectively broke a planned coordinated disclosure, causing immediate ripple effects across the web development community. The user, known by the handle petecooper, stated that they were unaware such a restriction existed and intended to warn other developers about the urgency of the issue.

The situation began with the discovery of two remote code execution bugs tracked as CVE-2026-109618 and CVE-2026-109619. Both flaws are rated with a severity score of 9.2, placing them in the critical category. The PHP Foundation had planned a controlled release of this information to give website owners and application developers a window to apply patches before the flaws became widely known. This standard practice is designed to minimize the window of opportunity for attackers to exploit the weaknesses in the software.

Petecooper explained in their statement that they shared the information to alert followers of PHP’s four-week release cycle that the matter was significant. They described themselves as a self-employed consultant and the solo founder of a mental health non-profit, noting that they had no formal affiliation with the organizations involved in the disclosure. The user claimed that a contact had told them there was no embargo, a detail that the contact’s own source had also reportedly confirmed.

In their apology, petecooper acknowledged the additional workload and schedule changes their post caused. They wrote, "I appreciate this has had considerable knock-on effects with the schedule for co-ordinated disclosure, and created additional workload. I am truly sorry. I take full responsibility for my actions." They emphasized that causing these side effects was never their intention, but they accepted full responsibility for the timing of their post.

The early leak was not an isolated incident. Several other sources had already shared details on social media and other platforms before petecooper’s post. This cascade of early information pushed the PHP Foundation to bring its official announcement forward by one day. The foundation also noted that the company Chainguard had broken the embargo by more than six hours prior to the official release.

Dan Lorenc, the co-founder and CEO of Chainguard, defended his company’s actions on LinkedIn. He stated that he acted after speaking with several other researchers in the field. Lorenc explained that once the fix for the vulnerabilities was released publicly, he chose to notify the broader group of researchers rather than limiting the announcement to his company’s customers.

The two flaws are bugs located within the PHP runtime itself. They were identified using artificial intelligence tools, rather than being the result of attacks by rogue AI systems. This distinction is important for understanding how the vulnerabilities were found and how they might be discovered in the future.

The use of AI tools in this discovery highlights a broader trend in cybersecurity. These tools can help both security researchers and malicious actors uncover vulnerabilities that may have existed in widely used code for years or even decades. This dynamic turns each discovery into a race to develop and deploy a fix before the flaw can be exploited in the wild.

For the average user or business relying on PHP, the immediate takeaway is the need to stay updated with security patches. The early disclosure, while disruptive to the planned schedule, ensured that the critical nature of the bugs was widely understood. The PHP Foundation has moved forward with the public release, and affected systems should now be prioritizing the application of the latest security updates.

The incident serves as a reminder of the challenges involved in coordinating complex security disclosures. Even with established protocols, information can leak through multiple channels. As AI tools become more common in code analysis, the frequency of such discoveries may increase, requiring faster and more coordinated responses from software maintainers and users alike.