if you received the information about the RCEs without the information about the embargo, then you did not break the embargo. someone else up the chain did.

this whole saga will be analyzed and we'll all come out better for it at the end.

▲

k1w1 3 hours ago | parent | next [-]

> if you received the information about the RCEs without the information about the embargo, then you did not break the embargo.

Doesn't responsible disclosure also apply? If I become aware of a vulnerability that doesn't seem to be widely known shouldn't I first attempt to report the issue responsibly?

In this case it appears the OP did know about the embargo "A reliable source has indicated an announcement is scheduled". I think that with security disclosures it is assumed they are not supposed to be publicized before the announcement, but if he hadn't known about the announcement and only heard about the RCEs, then publicly announcing their existence doesn't seem OK either.

	▲	nahsra 2 hours ago \| parent \| next [-]
		Just FYI, "responsible disclosure" is a term that many people (like me) dislike because it carries judgment about the merits of public disclosure that are not at all obvious. This term came from an era where companies or projects were disrespectful and dismissive towards security researchers. Those orgs were generally bad risk practitioners, and they coined the term "responsible disclosure" to mean "you send us the info and we'll do whatever we want with it, for however long we want, etc". Many security people (like me) prefer the term "coordinated disclosure" as a way to indicate a practice where both discoverer and patcher participate in a good faith, communicative, and timely process to get things fixed for the community. The difference can be summed up like this: if I report vulnerability X to company Y, and company Y sits on it for 3 years, that is not responsible. It is more "responsible" (especially today) to report it to the public, so they can protect themselves in a non-official-patch way, because the likelihood of bad guys knowing about it and exploiting it are approaching near-certainty. These terms are obviously not super scientific, but I try to point out the history whenever it comes up.
	▲	derekerdmann 3 hours ago \| parent \| prev [-]
		That approach to disclosure is about discovering vulnerabilities. Talking about something with a published CVE isn't really comparable.

▲

theteapot 5 hours ago | parent | prev | next [-]

Doesn't the embargo end when the CVE is published? I thought that's the whole point in CVE allocate != CVE publish.

▲

da_chicken 4 hours ago | parent | next [-]

No, a CVE being assigned or allocated can happen well in advance. It's just requesting an identifier and it can be reserved very early.

For example: https://www.cve.org/CVERecord?id=CVE-2026-50000

	▲	david_shaw 3 hours ago \| parent [-]
		I think that's what they're saying. Assigning the CVE happens much earlier than actually publishing, but it's the latter that ends the embargo.

▲

octoberfranklin 5 hours ago | parent | prev [-]

No, CVEs can be allocated before a vulnerability has even been found!

▲

theteapot 2 hours ago | parent [-]

Not sure that contradicts the claim. Publishing the CVE is what makes it public.

	▲	eqvinox 2 hours ago \| parent [-]
		The CVE record wasn't published yet when this particular embargo got broken. AFAIK it got published when the embargo ended, as it should. (I wasn't following anymore at that point, don't know for sure.) What did happen is that a whole bunch of people had no clue and called the fact that "these 2 CVE IDs will be used for a PHP vulnerability" a CVE leak. Posts were going around yelling "CVE leak!" with a CVE database link that said "no information yet". Part of this is the mushed usage of "CVE" to just mean "vulnerability" rather than "CVE record". But still, quite ridiculous, and annoying. Information that CVE ID XYZ will be used for project ABC is not a leak. Like you say, CVE publishing matters. Getting the CVE record contents would be a leak.

▲

KennyBlanken 6 hours ago | parent | prev | next [-]

[flagged]

▲

user43928 5 hours ago | parent | next [-]

By now I've seen at least 5 different people or companies blamed for leaks or releasing fixes early.

If anyone is at fault here, I'm looking at the PHP maintainers.

The embargo apparently held for like two months, during which they have not managed to release patches.

▲

InsidiousWombat 3 hours ago | parent | next [-]

AFAIK it's pretty much to allow the security cabal of companies that get the early access to fix their stuff first before the dirty public can be granted privilege of fixing the bugs.

	▲	ern 2 hours ago \| parent [-]
		I've been wondering about this in general. The Glasswing/Mythos and whatever the OpenAI equivalent is seem to be creating a privileged caste, on the other hand opening it up quickly means more attacks. Maybe a defined sunset for cyber capabilities being gated is the answer?

▲

nekusar 5 hours ago | parent | prev [-]

> If anyone is at fault here, I'm looking at the PHP maintainers.

There's a reason the moniker PHP was "pretty horrible programming".

And well, things haven't changed in that regard.

▲

EA-3167 5 hours ago | parent | prev [-]

If you're seriously asking whether or not it's possible that someone was overconfident and thoughtless rather than malicious and calculating... yeah I find that very easy to believe. Process safety exists because as individuals and as groups we suck at this.

	▲	aiisjustanif 5 hours ago \| parent [-]
		It’s even an HN community guideline ironically, assume good faith.

▲

kinduff 7 hours ago | parent | prev [-]

I hope this is bait because that's not how it works.

▲

kinduff 7 hours ago | parent | next [-]

Okay, my bad. I didn't know he was not participating in the embargo.

▲

cperciva 7 hours ago | parent | prev | next [-]

This is exactly how it works. People who are part of the embargo are responsible for making sure that anyone they share information with -- which should usually be nobody! -- are aware of and abide by the embargo.

▲

john_strinlai 7 hours ago | parent | prev | next [-]

you cannot be subject to an embargo of which you had no knowledge and took no participation in.

the embargo was already broken when pete received the information.

▲

michaelbuckbee 7 hours ago | parent | prev | next [-]

So if I read the post here and told someone, would I be breaking the embargo?

	▲	kinduff 7 hours ago \| parent [-]
		No, you didn't. I misread.

▲

dylan604 7 hours ago | parent | prev | next [-]

This is not a situation where "Ignorantia juris non excusat" applies.

▲

garbageman 6 hours ago | parent [-]

I'm trying to follow but how could one possibly know information (the embargo) that has not been shared?

For the law, you can say that the law has been published and is at least available for review.

	▲	dylan604 5 hours ago \| parent [-]
		that's my point. Someone cannot come at you saying you were still under the rules of the embargo if you had no idea the embargo existed so now you're in violation and get to suffer the consequences. You cannot say that about the law.

▲

landl0rd 5 hours ago | parent | prev [-]

Yes, it is.