HN user apologizes for early PHP RCE disclosure
What happened
On October 22 a Hacker News user posted an apology for unknowingly disclosing embargoed information about a PHP remote code execution (RCE) vulnerability ahead of time. Most commenters said people not told about an embargo should not be blamed, and that the fault lies further up the information chain. Others asked why PHP maintainers did not ship a patch during the roughly two-month embargo. Discussion also covered exploit difficulty and impact; some said most public proofs of concept (PoCs) do not work, but a working private PoC exists. The report covers the apology and the community debate over disclosure responsibility, patching and exploitability.
Written by AI from the coverage · updated 32 minutes ago
Coverage
Follow the reports to see the story from different sides.
- Hacker News front pageTell HN: I unknowingly broke the PHP RCE embargo. I am sorry.
一位 Hacker News 用户发帖称自己在不知情的情况下泄露了 PHP RCE 漏洞的禁运信息并致歉。评论区多数观点认为，未被告知禁运的人不应对此负责，责任在信息传递链条上游；也有人质疑 PHP 维护者在约两个月禁运期内未能发布补丁。讨论还涉及该漏洞的利用难度与影响范围，有人称公开的 PoC 大多无效，但存在可用的非公开 PoC。
Heat over time
Not enough continuous observations to draw a trend yet.