I am truly sorry. I take full responsibility for my actions.
It was not remotely my intention to cause any of the subsequent side effects.
At the time of posting, I didn't know about any embargo. My contact had told me there was no embargo, and her contact had told her the same thing.
As someone who follows the 4-weekly PHP release cycle and compiles it from source, my intention was to alert others in a similar position to be aware of the importance/urgency of the updates.
That clearly backfired in a pretty wild fashion. I have learned my lesson.
If you're not a party to an embargo, and no one told you an embargo even exists... you should not follow the embargo. In fact, you should maybe even consider leaking basic details or challenging the embargo if you are in this situation. In your situation, they had lost information asymmetry before the news got to you. I don't know where people got the idea that unrelated third parties have to follow embargos.
Embargos are not about keeping secrets, they are about the game theory of coordinated disclosure.
I prefer them going public over breaking the embargo as silently breaking embargos and publishing details about vulnerabilities to an uncontrollably large group of unvetted people is worse.
I hope the broader ecosystem responds by putting their customers over Chainguard. The Chainguard customers can then get security updates after the embargo was lifted and Chainguard noticed.
and you weren't coordinated with
this whole saga will be analyzed and we'll all come out better for it at the end.
Doesn't responsible disclosure also apply? If I become aware of a vulnerability that doesn't seem to be widely known shouldn't I first attempt to report the issue responsibly?
In this case it appears the OP did know about the embargo "A reliable source has indicated an announcement is scheduled". I think that with security disclosures it is assumed they are not supposed to be publicized before the announcement, but if he hadn't known about the announcement and only heard about the RCEs, then publicly announcing their existence doesn't seem OK either.
This term came from an era where companies or projects were disrespectful and dismissive towards security researchers. Those orgs were generally bad risk practitioners, and they coined the term "responsible disclosure" to mean "you send us the info and we'll do whatever we want with it, for however long we want, etc".
Many security people (like me) prefer the term "coordinated disclosure" as a way to indicate a practice where both discoverer and patcher participate in a good faith, communicative, and timely process to get things fixed for the community.
The difference can be summed up like this: if I report vulnerability X to company Y, and company Y sits on it for 3 years, that is not responsible. It is more "responsible" (especially today) to report it to the public, so they can protect themselves in a non-official-patch way, because the likelihood of bad guys knowing about it and exploiting it are approaching near-certainty.
These terms are obviously not super scientific, but I try to point out the history whenever it comes up.
Did they assume the information came from upstream php? I think if i got a new version of php that i thought was coming from official sources, i would assume there is nothing to responsibly disclose.
For example: https://www.cve.org/CVERecord?id=CVE-2026-50000
Assigning the CVE happens much earlier than actually publishing, but it's the latter that ends the embargo.
Consider this example:
https://www.cve.org/CVERecord?id=CVE-2026-113119
At this time, the corresponding Chromium bug tracker entry is still private:
https://issues.chromium.org/issues/557075191
(I just picked this one at random, I haven't checked if the information is publicly available from another source.)
What did happen is that a whole bunch of people had no clue and called the fact that "these 2 CVE IDs will be used for a PHP vulnerability" a CVE leak. Posts were going around yelling "CVE leak!" with a CVE database link that said "no information yet". Part of this is the mushed usage of "CVE" to just mean "vulnerability" rather than "CVE record". But still, quite ridiculous, and annoying. Information that CVE ID XYZ will be used for project ABC is *not* a leak. Like you say, CVE publishing matters. Getting the CVE record contents would be a leak.
If anyone is at fault here, I'm looking at the PHP maintainers.
The embargo apparently held for like two months, during which they have not managed to release patches.
There's a reason the moniker PHP was "pretty horrible programming".
And well, things haven't changed in that regard.
the embargo was already broken when pete received the information.
For the law, you can say that the law has been published and is at least available for review.
We're all (well, I guess not all, but the group that's worth caring about, and I hope it's at least most) just operating the best we can on the information we have and trying to make decisions based on that. As long as you're acting in good faith on information that you had genuine basis for believing is true, it seems like it would be unreasonable to expect someone in your situation to somehow intuit that you were given false information or grossly misunderstood what sounds like a pretty straightforward declaration of fact from someone you didn't have any reason to doubt.
At the risk of some armchair paycholoanalysis because it does seem like you genuinely feel some guilt over this: I can emphathize feeling guilty about the outcome of an action that in a vacuum would not have been hard to make differently, but my experience is that those of us who have a nasty habit of beating ourselves up over things when we really don't have much blame will often recognize when on the other side that it would not be fair to hold someone else to that standard. I struggle a lot with how sometimes knowing something is true doesn't always make it feel true, and even though hearing someone else saying it doesn't magically make it all better, I still think it's valuable to hear it from someone else, so if I happen to be right about how you're feeling, nothing about all of this is your fault, and to the extent that you're able to, try not to beat yourself up over your misfortune to get caught in the middle of all this due to circumstances that realistically were outside your control.
It will be headlines on Hacker News regardless due to sheer sensationalism, I think most DevSecOps people would rather find out the news here first than via their boss calling them after reading the morning news.
Due to the insane media coverage there'll of course be a deluge of PoCs, most of which won't work. But constantly refreshing Twitter to see whether there's a working PoC is not a good use of time nor a great security strategy.
Maybe a LAMP stack on an extremely ancient version of Linux is vulnerable out of the box. Quit the fear mongering please, you do the security community no favors.
educate yourself
https://oliviagallucci.com/aslr-bypass-techniques-and-circum...
The only thing you have to know in advance is the relative memory offset distances, and that's it. Memory feng shui was the longest part of the implementation.
[1] https://github.com/cookiengineer/actual-php2shell
It is split up into two branches and demos, see the heap feng shui document?
ASLR enabled requires a way to create more data, which I intentionally did not create in the index.php because other folks claimed that is "cheating". That was the demo that wiz created.
Maybe you should read the repo next time? It is literally headline 4.
The whole point of this demo is that the assumed to be hard part (mem feng shui) is what LLMs are actually good at.
Read the heap feng shui doc, and headline 4 in the README.
The involved heap feng shui is independent of ASLR.
... and maybe read up on what ASLR actually does and how memory arenas work before trying to be smart?
Reality is that everyone has to make decisions in finite time, using the resources they actually have.
And I'd put a whole lot more responsibility further up that chain of contacts. And question how many other people they might have blabbered to.
100%. I'm concerned about the two-way street this might also have opened me up to with information I shared privately with this individual. Nothing significant or incriminating, but the professional relationship is concluded.
> I have learned my lesson.
If what you've said is true, and you were not aware of the embargo... then you are not responsible.
By taking responsibility, you're actually making the whole debacle even worse, because you are clouding the actual responsible PROCESS that failed.
Note I said process, and not person. In a situation like this, the post-mortem MUST be blameless. If people are afraid or feel ashamed, and don't come forward, then that's how even worse outcomes can start getting lined up. Blameless, not even to you, but the person who told you, and who told them, all the way up the chain.
If there are people in your organization who are trying to pin this on you, you must push back. It isn't right, and it isn't fair.
(For clarity, I’m being facetious, but it’s a really meaningless and empty phrase to commit to the written record.)
I posted something that -- in hindsight -- I shouldn't have, and it had repercussions for a lot of people. An action that I took had considerable knock-in effects around the world.
Some outlets are reporting that my action of posting something that I believed to be in good faith was an indicator or catalyst for the embargo to be tossed out and a previously-agreed schedule to change in short order.
That's not a normal Wednesday for me. Not even vaguely. I've not slept well since, and my taking ownership with an apology is this new course of action. Hopefully I'll sleep tonight.
re: assets and peonage – I am but a broke & wizened nerd with no known descendants. If you're ever in Cornwall, UK: look me up, I'll gladly buy you a sleep-friendly beverage. And I’m not being facetious.
But yeah, it happens. I could share some stories of me (being responsible for) bricking multiple ~200k circuit boards in a row, if that makes it better. In the end nobody really cared and the world kept on turning. Good decisions might come from experience, but experience comes from bad decisions. It's how it is.
Years ago I lost $250K at work, well gave away, so real money out the door. I figured out why we were bleeding, that the mistake was mine (2008 vs 2009 in a function) and then changed the pattern to use explicit names rather than numbered events.
I figured at the end of the day I was fired. My boss laughed at me and told me good job for owning my mistake, fixing it, and then making sure it could not happen again.
Honestly don't just apologize - tell the whole story, in full. Tell us what you should have done differently at each step. Tell us where the process failed you and us. Those sorts of narratives and suggestions are how processes get improved. There is a humble and informative post mortem that you can write up and publish (beyond HN) for everyone's edification. But that should honestly be a Monday thing, when you have a clear head and some more perspective on the whole situation.
Honestly though, dont beat yourself up over this.
i forget the origin of the story, but i loosely remember a story about a boss and employee in a similar situation. the important bit was the bosses line ($ adjusted to match your story):
"why would i fire you when i just spent $250k training you"
> Any fool can criticize, condemn, and complain—and most fools do.
> But it takes character and self-control to understand and forgive.
> “A great man shows his greatness,” said Carlyle, “by the way he treats little men.”
> Bob Hoover, a famous test pilot and frequent performer at air shows, was returning to his home in Los Angeles from a show in San Diego. As described in the magazine Flight Operations, at three hundred feet in the air, both engines suddenly stopped. By deft maneuvering he managed to land the plane. It was badly damaged, but fortunately neither he nor his two passengers were hurt.
> Hoover’s first act after the emergency landing was to inspect the airplane’s fuel. Just as he suspected, the World War II propeller plane he had been flying had been loaded with jet fuel rather than gasoline.
> Upon returning to the airport, Hoover asked to see the mechanic who had serviced his airplane. The young man was sick with the agony of his mistake. Tears streamed down his face as Hoover approached. He had just caused the loss of a very expensive plane and could have caused the loss of three lives, as well.
> You can imagine Hoover’s anger. One could anticipate the tongue-lashing that this proud and precise pilot was about to unleash for that carelessness. But Hoover didn’t scold the mechanic; he didn’t even criticize him. Instead, he put his big arm around the man’s shoulder and said, “To show you I’m sure that you’ll never do this again, I want you to service my F51 tomorrow.”
I've been meaning to reread it for a while.
however, it's much the same in spirit as the one you posted, thanks!
> In the 1960s, an executive at IBM made a decision that ended up losing the company $10 million (about $70 million in 2009 dollars). The CEO of IBM, Tom Watson, summoned the offending executive to his office at corporate headquarters. The journalist Paul B. Carroll described what happened next:
[0] https://www.google.com/books/edition/Switch/ad5ktG0oe00C?hl=...Aside from Pete's reply (see adjacent comment), I'd add that him taking full responsibility is also his way of saying his post was nobody else's fault but his.
In other words it's less about forfeiting assets and descendant peonage, and more about saying "the buck stops with me".
At least that's my read of his sentiment. Pete can expand if need be.
"Take full responsibility" is also something someone set up as a scapegoat might say. By claiming nobody else influenced, coerced, or otherwise convinced them to make that statement, every/any one else involved can then wash their hands of the situation.
I'm merely playing devil's advocate here, and it's just a sign of the times that a person making an honest admission can be interpreted in such a manner.
I'm not a scapegoat. Aside from a few brusque messages and a few people from my past finding me on LinkedIn, I've heard nothing from anyone.
I've seen my HN username mentioned on various outlets, and That Post© has been linked from a Wikipedia article, so I can chalk this up to experience. My fear (?) is that HN would get a reputational clobbering from me 'leaking', but given the other moving parts in this whole event I probably shouldn't be too concerned.
It's been a while since I've been involved in an international event, I'm a bit rusty on it!
That's about it.
But most importantly, by assigning blame, they have cleared the contention at hand, taking the critical first step towards resolution of the matter. Without this, the issue may simply be stuck in limbo, taking up valuable time and resources and may never be resolved even. By acknowledging their mistake, they also wish to signal to others that they have learnt a peronsal lesson and would try to avoid making the same mistake in future. So it carries a lot of implications and is not an empty phrase at all.
Sure there may be people who throw around the phrase lightly, whether one believes them or not depends on how they are viewed in the eyes of others. So unless there is reason to believe otherwise, I would give them the benefit of doubt. If you want to imagine a world where the concept of "taking responsibility" doesn't exist, look at politicians. Is that how we want our society to function?
So many people give non-apologies where they say sorry while also trying to deflect blame elsewhere, i think it speaks well of this person they are not doing that.
And honor is in the action, dishonor in the words.
Could have said "I blame only myself for this mistake, nothing else needs to change".
This will keep happening until the system where this can happen runs out of willing scapegoats.
I'm not saying it needs to be a public burning, but I sure hope someone figures out who dropped the critical metadata bit so they can avoid telling that party critical things in the future.
If the component removed is a human, the situation is worse. Then you're creating an incentive to hide mistakes and assign blame to others. This makes it even harder to improve the system properly, because then the information you need to improve the system no longer gets to you undistorted.
That's why we have to design systems that don't assume components are perfectly reliable, and ensure any human components that we're not out to get them, we're out to create an environment where they will find it hard to make mistakes.
The author (Palanhuik, sp?) wrote the "core" of Fight Club in 2 hours (it's either Chapter 5 or 6, from memory). It "came to him," wasn't entirely his own work, the keys on his typewriter just getting tapped. I do not remember which author-interview he states this in, but his creative processes are worth listening/exploring (for both writers and not).
>the film adaptation rivals the original work
He was heavily involved in the film adaptation.
----
Rant (his other great book, IMHO) is Freudian time-travel-rape at its best (worst?) – I don't even like the genre! but his perspectives help you think beyond normalcy/complacancy, however offputing.
- I've been able to notify the clients that we are going to have to take urgent action;
- Had some time to figure out what actually happened;
- Set up monitoring to know when the fix is out;
- Managed to compile the new binaries the moment they became available.
This getting out before the fixes were published sucked, but they would've sucked anyways.
This getting out at least allowed me to inform some of my previous colleagues that they had services that were affected and they were able to shut them down until we had a proper fix available.
There's a rule about not pushing to prod on Friday. I feel the same should apply for security patches ;-)
I have been with clients that has that 'don't push to prod on Friday' like it was 2010. It is so frustrating, basically loosing 20% of your work week and batching work for a deluge on Monday.
It is a red flag of flaky architecture and low confidence in ops processes.
Though pushing at 5pm on a Friday is a bit of a dick move.
It is not your lesson to learn. You tried to be helpful, in a way that you had no idea was verboten. Unlearning being helpful is not a good outcome of this.
It being a potentially massive security issue, taking care to make sure it is safe to release the information is definitely something that should happen, but it appears that you did this:
> My contact had told me there was no embargo, and her contact had told her the same thing.
I'm pretty sure I'd have been more cautious given that the CVE details were not minimal, as this usually implies that releasing the details is expected to cause early exploitation¹, and wouldn't have discussed it as publicly as on HN, but don't kick yourself too much for having done so. You did not break the chain, someone before you, maybe several links before you, did by telling others without giving them information about the need for an embargo.
--------
[1] Perhaps that is a lesson to learn, rather than the not being helpful one? Even then that is a small correction to your level of caution, the big lesson (“FFS be careful, things are embargoed for a reason”) is still for those before you in the chain.
If someone (independently) found an exploit and weren't thinking of the public interest, they would want to keep it secret and for their own use.
That's not what taking responsibility means.
> My contact had told me there was no embargo,
So, someone else broke the embargo and you decided to take the fall?
Well that's exactly what chainguard claims though. "Find bad bugs in PHP" is the prompt they claim they used to rediscover the issue
You clearly aren't that person.
Regarding your perceived mistake, we all make them.
Please forgive yourself and understand that the negative feelings and thoughts you are having are a mark of decency but do not represent reality, and if they persist please seek help to get you back on track.
As an aside, to you and those like you who take on the task of fighting and protecting against these attacks with often nothing to gain except hurt like this:
Thank you for your service.
Nothing to apologise for.
Today's PHP security release, and how we're strengthening security
https://news.ycombinator.com/item?id=50182987
and then everyone sht on me on reddit.
Meaning? Like... global financial fallout?
> I have learned my lesson.
Meaning? Like... feel bad for a week, and then back to normal?
https://news.ycombinator.com/item?id=50183326
And there is you who is taking responsibility for an embargo you did not know about!!
This entire RCE race is always annoying.
All in all, I think this leak increased the value of developers, so I am thankful for your leak.
Good shit
Security is important but the people in the security field are clowns and it seems it has gotten worse over the last 20 years.
I know breaches are often kept under wraps, and there's a long tail. But is there any evidence of impact at this point? Were any sites compromised that we know about? There was a lot of hullabaloo, with foreign and domestic LE agencies recommending sites be taken offline (holy shit!).
Was this like Y2K where, based on the coordinated action of many, a real issue was addressed in time? Or is it like Hale Bopp where everybody watched, and a few casualties in the preparation, but ultimately a nothingburger?
Flame on!
Everyone knew about the vuln well before the patches going live. The embargo, at that point, made things worse.
In plain english, please.
Whether someone just leaked the CVE numbers or just ”there is a big bug in PHP” - that should not be enought to accelerate finding that bug. But other information that pins the bug for specific property or feature makes it easier to find and race against patching starts.
And at that point you don’t really know if someone really found it or not, since only few big organisations can collect that much data to detect successful exploiting. And most ”PoC”:s in the wild were credible-looking but vibecoded mess that did nothing what sources claimed.
Until there is absolute evidence that exploitation happens in the wild, succesfully, you don’t leak the patch or bug details beforehand.
In this case, the area where the bug is in PHP, leaked partially, but apparently there was no enough evidence that it was exploited succesfully or if any of the PoCs in the wild actually worked properly. So patch or related detailed information was not released before the initial schedule.
Could this be a variant of the survivorship bias? Maybe only the low quality PoCs ended up in the honeypots while the more capable actors avoided them.
I could see the value of the embargo in the old world of “6 uber security firms and a few bounty hunters” but the new world of pointing AI at the PHP source just seems flimsy.
Thanks for owning it ,the best thing now is ensuring the patch details are clear once the official release drops. Moving forward is what matters
I would like this to materialize, but that's just empty words.
> It was not remotely my intention to cause any of the subsequent side effects.
What were your intentions, then?
> my intention was to alert others in a similar position to be aware of the importance/urgency of the updates.
Have you lived under the stone for the past few years with respect to cybersecurity? Yes you have. All of you ignore security as in "it doesn't apply to me", "they won't break into my software because I'm truly the best 10x developer in the world" etc.
> I have learned my lesson.
I certainly doubt that. A person with IQ only a tiny bit bigger than Trump's wouldn't seek public attention so badly to disclose a security hole in a public forum.
When such praise-seeking habits have stopped being embarrassing?
You have sinned.
Your penance:
Three Hail Claude's, one Our GPT and an act of loop engineering.
Two minutes of silent prompting.
Amen
You cannot foresee the financial/civil consequences of that RCE and some people might be looking for scapegoats in the future.
People and companies do get sued with the full intention of a settlement and it never going to trial. But that only happens when the defendant has deep pockets or good insurance.
> Anyone can sue anyone else for any reason.
And it's easier to have cause to sue when someone publish an "admission of guilt", which makes a lawsuit harder to dismiss thus costlier.
https://med.stanford.edu/news/all-news/2017/10/in-patient-in...
> New research shows that discussing hospital errors with patients leads to better patient safety without spurring a barrage of malpractice claims.
No it doesn't have anything to do with what I said. The OP has no contractual or legal obligations toward any community, unlike a doctor and their patients in case of medical error.
edit:
> A doctor has no contractual obligation to apologize, either.
> But it can help prevent things from going to lawsuits, versus the "fuck you I admit nothing" approach that sometimes just pisses people off.
OP isn't a doctor as far as you know, and isn't apologizing to a specific person. OP can't be bound to an embargo he didn't know about and wasn't involved in any decisions.
You're completely off topic and you just want the last word.
Your ramblings have nothing to do with anything I have said.
But it can help prevent things from going to lawsuits, versus the "fuck you I admit nothing" approach that sometimes just pisses people off.