Doesn't the embargo end when the CVE is published? I thought that's the whole point in CVE allocate != CVE publish.

No, a CVE being assigned or allocated can happen well in advance. It's just requesting an identifier and it can be reserved very early.

	▲	david_shaw 3 hours ago \| parent [-]
		I think that's what they're saying. Assigning the CVE happens much earlier than actually publishing, but it's the latter that ends the embargo.

No, CVEs can be allocated before a vulnerability has even been found!

Not sure that contradicts the claim. Publishing the CVE is what makes it public.

	▲	eqvinox 2 hours ago \| parent [-]
		The CVE record wasn't published yet when this particular embargo got broken. AFAIK it got published when the embargo ended, as it should. (I wasn't following anymore at that point, don't know for sure.) What did happen is that a whole bunch of people had no clue and called the fact that "these 2 CVE IDs will be used for a PHP vulnerability" a CVE leak. Posts were going around yelling "CVE leak!" with a CVE database link that said "no information yet". Part of this is the mushed usage of "CVE" to just mean "vulnerability" rather than "CVE record". But still, quite ridiculous, and annoying. Information that CVE ID XYZ will be used for project ABC is not a leak. Like you say, CVE publishing matters. Getting the CVE record contents would be a leak.