> At the time of posting, I didn't know about any embargo. My contact had told me there was no embargo, and her contact had told her the same thing.

If you're not a party to an embargo, and no one told you an embargo even exists... you should not follow the embargo. In fact, you should maybe even consider leaking basic details or challenging the embargo if you are in this situation. In your situation, they had lost information asymmetry before the news got to you. I don't know where people got the idea that unrelated third parties have to follow embargos.

Embargos are not about keeping secrets, they are about the game theory of coordinated disclosure.

if you received the information about the RCEs without the information about the embargo, then you did not break the embargo. someone else up the chain did.

this whole saga will be analyzed and we'll all come out better for it at the end.

That’s kind of you, Pete, but it was leaked and being exploited well prior to your previous posting here: https://aws.amazon.com/blogs/security/amazon-threat-intellig...

Don't be silly, you can't possibly be responsible for breaking an embargo you weren't subject to or informed about.

Hey man, you're probably feeling pretty shit right now.

> I have learned my lesson.

If what you've said is true, and you were not aware of the embargo... then you are not responsible.

By taking responsibility, you're actually making the whole debacle even worse, because you are clouding the actual responsible PROCESS that failed.

Note I said process, and not person. In a situation like this, the post-mortem MUST be blameless. If people are afraid or feel ashamed, and don't come forward, then that's how even worse outcomes can start getting lined up. Blameless, not even to you, but the person who told you, and who told them, all the way up the chain.

If there are people in your organization who are trying to pin this on you, you must push back. It isn't right, and it isn't fair.

What does “take full responsibility” mean in the present context? Are you forfeiting all your assets and pledging the next twenty generations of your descendants into peonage?

(For clarity, I’m being facetious, but it’s a really meaningless and empty phrase to commit to the written record.)

> At the time of posting, I didn't know about any embargo. My contact had told me there was no embargo, and her contact had told her the same thing.

I'm not saying it needs to be a public burning, but I sure hope someone figures out who dropped the critical metadata bit so they can avoid telling that party critical things in the future.

Oh just imagine if politicians talked like that.. (off topic I know)

It was exploited publicly even before the wide publicity following your post so the ultimate negative impact that you may be imagining, is actually quite small. Once it is publicly exploited the benefit of coordinated disclosure delays is hard to square with the risk.

The first rule of the fight club only applies if you know about the fight club.

You were not under any embargo. This only goes for the first person in the chain, whoever that was and there is absolutely nothing to apologize for.

As an Australian I thank you. I'd much rather have spent all day today patching things than tomorrow. It's Friday afternoon right now!

There's a rule about not pushing to prod on Friday. I feel the same should apply for security patches ;-)

I don’t know if embargoes have much effect anymore. They used AI to find this issue, meaning anyone else could also find the issue with time and the right model. The clock is always ticking after a CVE but now it ticks faster. I am certain that companies like Cellebrite are pointing a bunch of models at popular repos and filing away all the exploits they find in a database.

I also got that information before your post. I believe an embargo is impossible to keep up when it takes way too long to get a fix out.

"You never blow the cover of an agent in the field." --Jackson Lamb

Don't feel too bad. Just knowing a "10.0" RCE CVE is inbound w/o extra details doesn't get you very far. The actions of calif.io and Chainguard after your post was what caused the damage.

All vulnerabilities should be disclosed immediately, publically. That would over a short time lead to much better security practices.

Thanks Pete. I appreciate you taking the time to post here.

I really hope this isn’t chewing at you and that you’re just trying to do what you feel is the right thing by posting this.

The only bad guys here are those who exploit issues like this for unethical reasons.

You clearly aren't that person.

Regarding your perceived mistake, we all make them.

Please forgive yourself and understand that the negative feelings and thoughts you are having are a mark of decency but do not represent reality, and if they persist please seek help to get you back on track.

As an aside, to you and those like you who take on the task of fighting and protecting against these attacks with often nothing to gain except hurt like this:

Thank you for your service.

It's ok. Hopefully people took it seriously and updated quickly.

“I don't get it. Why are they confessing?” “They're not confessing.” “They're bragging.”

Hope you're doing alright mate. Seems like an honest attempt to do the right thing to me. Get some sleep.

Nah, you just repeated something that to you was a rumor.

There are companies whose "rogue" agents have hacked 6 7 companies and at least 2 3 govts. They haven't faced any consequences at all! They actually hacked into those companies

And there is you who is taking responsibility for an embargo you did not know about!!

> I take full responsibility for my actions.

Meaning? Like... global financial fallout?

> I have learned my lesson.

Meaning? Like... feel bad for a week, and then back to normal?

Related (where you already posted a bit of this):

Today's PHP security release, and how we're strengthening security

https://news.ycombinator.com/item?id=50182987

are you the guy working at Chainguard publishing images...?

Who told you about it?

hey Pete, don't carry the world upon your shoulders

Honestly this has been the most fun week I've had, thanks to this leak. I'm grateful. Fun stuff happened, shitty companies learned the value of capable and fast engineering teams.

All in all, I think this leak increased the value of developers, so I am thankful for your leak.

This does feel like the fix took so long to bake and was so obvious way too many people who are into PHP knew about it, I knew about eMudra's cert issue as soon as Chrome and Firefox pushed updates to disallow them for instance because of reasons, and it wasn't even fixed after it was all made public on several platforms, I think Apple still hasn't fixed it properly, the trust Store is still fucked not sure if Safari was separately patched, maybe there is an os update in the last few hours I missed.

This entire RCE race is always annoying.

So much pearl clutching from these security companies. An embargo isn’t an enforceable contract, expect it to leak and be ready to fast forward your plan. Don’t start pointing fingers because people protected themselves or their customers once the dam broke.

You're a good person with good intentions. Hope you get some rest sir.

i forgive you

It was a good thing. It started useful conversations and taught valuable lessons that we probably wouldn't have faced with a more "traditional" vuln disclosure/patch process. We're going to see this a whole lot more with AI, probably as 0-days. It's better that we got the fire drill out of the way now.

OP is being a big man about this

Good shit

The security field is full of a bunch of self important jagoffs that think they are “super smart”. Its all a joke and its sad that anyone feels they need to play these stupid games.

Security is important but the people in the security field are clowns and it seems it has gotten worse over the last 20 years.

You broke nothing, it's just another day my guy. Go for a walk, drink some water, you know, take care of yourself - others failed to follow a process, not like you threw out POCs left and right.

Yeah, I actually first heard it here from you.

It's ok. It's just php.

So.. what has the effect of this all been? I understand that the early release of POC exploits increased the pressure for mitigations in advance of the patch release and caused a lot of work and stress. I have read the tweets from Cloudflare with statistics for malformed requests related to suspected exploit attempts.

I know breaches are often kept under wraps, and there's a long tail. But is there any evidence of impact at this point? Were any sites compromised that we know about? There was a lot of hullabaloo, with foreign and domestic LE agencies recommending sites be taken offline (holy shit!).

Was this like Y2K where, based on the coordinated action of many, a real issue was addressed in time? Or is it like Hale Bopp where everybody watched, and a few casualties in the preparation, but ultimately a nothingburger?

Flame on!

Can someone, with the benefit of hindsight, explain the embargo ? Why isn't there a clause "if the vuln leaks, embargo is broken" . I still don't understand the fuss.

Everyone knew about the vuln well before the patches going live. The embargo, at that point, made things worse.

In plain english, please.

It happens. Information cascades are messy, especially with multi-layered contacts

Thanks for owning it ,the best thing now is ensuring the patch details are clear once the official release drops. Moving forward is what matters

> I take full responsibility for my actions.

I would like this to materialize, but that's just empty words.

> It was not remotely my intention to cause any of the subsequent side effects.

What were your intentions, then?

> my intention was to alert others in a similar position to be aware of the importance/urgency of the updates.

Have you lived under the stone for the past few years with respect to cybersecurity? Yes you have. All of you ignore security as in "it doesn't apply to me", "they won't break into my software because I'm truly the best 10x developer in the world" etc.

> I have learned my lesson.

I certainly doubt that. A person with IQ only a tiny bit bigger than Trump's wouldn't seek public attention so badly to disclose a security hole in a public forum.

When such praise-seeking habits have stopped being embarrassing?

x

Really hope you are not in the US. This kind of admission would be used against you in a civil trial, and lawyers love to sue for just about any reason under the sun. Someone could drag you to court and you might be able to defend yourself, but at an extremely painful cost both financially and emotionally. While I think that would be utter bullshit, that does seem to be the way this country operates now.

So who will be sued and/or state prosecuted?

This is definitionally humble bragging. First of all the apology is in bad faith because there is nothing to apologize for. We are all giving the discovered CVEs attention (the brag component) under the guise of an apology (the humble component). I am being downvoted by well meaning, people pleasers that don't mind if they waste our time and attention doing it. Sounds great.

Is there any insight on if this was a "Bug" or a "Sophisticated Feature" put there by state actors long ago that was now just discovered.