Person who leaked PHP vulnerability on Hacker News apologizes, saying they didn't know it was secret

What happened

PHP is a popular programming language used to build websites and web apps. Two serious security holes, nicknamed PHP2Shell, were found in it. The PHP security team planned to release a fix and details later. But a user named petecooper posted the planned date on Hacker News. Soon the bug details and an attack demo video spread online. The PHP team moved its release up and shipped emergency updates on October 21, 2026, Japan time. Many websites went into maintenance mode to install the patch.

Key facts

• The two bugs have a severity score (CVSS) of 10.0 on a scale that goes up to 10.0.
• Security firms Calif and OpenAI each found the bugs separately in August 2026.
• The emergency updates are versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
• The updates were released at 23:00 Japan time on October 21, 2026.

What an embargo is

An embargo is a agreed period when security details are kept secret. This gives software users time to install a fix before attackers learn how to use the bug. In this case, the embargo was supposed to protect PHP users until the patch was ready.

Why it matters

Once the bug details leaked, attackers could try to use them before many servers were updated. Some people said the post helped website owners prepare. Others said it gave attackers a head start. The story shows how quickly security news can spread, and how hard it is to keep a secret online.

What to watch

• Whether websites finish installing the PHP updates.
• Whether attacks using PHP2Shell are reported.
• How the PHP security team changes its process for sharing bug news.
• Whether petecooper's apology leads to new rules for posting security information.