A Hacker News user has issued a formal apology after inadvertently leaking sensitive information regarding two critical PHP vulnerabilities before the official, coordinated disclosure date. The user, known by the handle “petecooper,” took to the platform to address their role in the premature disclosure of CVE-2026-109618 and CVE-2026-109619—flaws that impact an estimated 70% of websites.
The vulnerabilities, both of which carry a severe 9.2 severity rating, were uncovered through AI-assisted research, which successfully turned a two-year-old bug that had previously stumped human developers into a functional exploit in just two weeks.
Petecooper’s original post, which broke the news before the PHP Foundation’s intended timeline, sparked significant controversy within the cybersecurity community. The user, who describes themselves as a self-employed consultant and non-profit founder with no formal affiliation to the organizations involved, claimed they were entirely unaware of any embargo.
“I appreciate this has had considerable knock-on effects with the schedule for co-ordinated disclosure, and created additional workload. I am truly sorry,” petecooper wrote. “It was not remotely my intention to cause any of the subsequent side effects. At the time of posting, I didn’t know about any embargo. My contact had told me there was no embargo, and her contact had told her the same thing.”
The PHP Foundation had initially planned a controlled rollout, intending to allow website administrators and security teams to apply patches before the details of the exploits became common knowledge. However, the early leak—compounded by multiple sources circulating the information prematurely—forced the foundation to accelerate its announcement by one day.
The leak was not isolated to a single platform or individual. Security firm Chainguard also faced scrutiny for breaking the embargo by over six hours. Dan Lorenc, CEO of Chainguard, defended his firm’s decision, stating on LinkedIn that he proceeded with the release after consulting with other researchers, and ensured the information was provided to the broader community simultaneously rather than favoring select clients.
The discovery highlights a growing tension in the era of artificial intelligence. While the flaws in the PHP runtime were identified through the use of AI tools, the same technology is increasingly being used by malicious actors to scan for and exploit vulnerabilities that have long existed in legacy code. Security experts warn that as AI lowers the barrier to entry for finding these hidden bugs, the race to patch them before they are weaponized has become a critical challenge.
As the industry continues to grapple with the fallout of this disclosure, the incident serves as a stark reminder of the complexities inherent in coordinated vulnerability disclosure (CVD) when information chains involve multiple third parties and AI-accelerated research timelines.
Disclaimer: This content is auto-generated for informational purposes only.
Source: Read Original News
