PHP bug leaker says sorry: "I didn't know it was secret"
The early disclosure on Hacker News reportedly forced PHP to rush out its fix.
According to livedoor news (@livedoornews), the person who leaked a PHP vulnerability to Hacker News has apologized, saying they "didn't know it was secret." The post says the embargo break forced PHP to rush its fix. It drew around 7,800 likes.
Security bugs are often kept under embargo, a period when only maintainers and a small group know the details, so a fix can be ready before attackers learn about the flaw. A leak cuts that time short and pushes everyone into a race.
Why it mattersThe episode connects to this week's PHP advisories, including the PHP Foundation's latest mitigation guidance on today's board. It is a reminder of how fragile coordinated disclosure can be, and how one post can change the timeline for millions of servers.
