At the time of posting, I didn't know about any embargo. My contact had told me there was no embargo, and her contact had told her the same thing.

If you're not a party to an embargo, and no one told you an embargo even exists... you should not follow the embargo. In fact, you should maybe even consider leaking basic details or challenging the embargo if you are in this situation. In your situation, they had lost information asymmetry before the news got to you. I don't know where people got the idea that unrelated third parties have to follow embargos.

Embargos are not about keeping secrets, they are about the game theory of coordinated disclosure.

this whole saga will be analyzed and we'll all come out better for it at the end.

Thank you.

I have learned my lesson.

If what you've said is true, and you were not aware of the embargo... then you are not responsible.

By taking responsibility, you're actually making the whole debacle even worse, because you are clouding the actual responsible PROCESS that failed.

Note I said process, and not person. In a situation like this, the post-mortem MUST be blameless. If people are afraid or feel ashamed, and don't come forward, then that's how even worse outcomes can start getting lined up. Blameless, not even to you, but the person who told you, and who told them, all the way up the chain.

If there are people in your organization who are trying to pin this on you, you must push back. It isn't right, and it isn't fair.

(For clarity, I’m being facetious, but it’s a really meaningless and empty phrase to commit to the written record.)

At the time of posting, I didn't know about any embargo. My contact had told me there was no embargo, and her contact had told her the same thing.

I'm not saying it needs to be a public burning, but I sure hope someone figures out who dropped the critical metadata bit so they can avoid telling that party critical things in the future.

Today's PHP security release, and how we're strengthening security

https://smackernews.com/item/50182987 HN

Because I guarantee that if the OP had access to this information, this embargo has leaked more broadly, and people without any ethical qualms about it have exploited that leakage.

- I've been able to notify the clients that we are going to have to take urgent action;

- Had some time to figure out what actually happened;

- Set up monitoring to know when the fix is out;

- Managed to compile the new binaries the moment they became available.

I take full responsibility for my actions.

Meaning? Like... global financial fallout?

I have learned my lesson.

Meaning? Like... feel bad for a week, and then back to normal?

And there is you who is taking responsibility for an embargo you did not know about!!

There's a rule about not pushing to prod on Friday. I feel the same should apply for security patches ;-)

This getting out before the fixes were published sucked, but they would've sucked anyways.

This getting out at least allowed me to inform some of my previous colleagues that they had services that were affected and they were able to shut them down until we had a proper fix available.

It is clear as day that this industry is fucked, and has no clue on how to deal with operational security for sensitive information. It is what it is at this point. The days of full disclosure are back.

You clearly aren't that person.

Regarding your perceived mistake, we all make them.

Please forgive yourself and understand that the negative feelings and thoughts you are having are a mark of decency but do not represent reality, and if they persist please seek help to get you back on track.

As an aside, to you and those like you who take on the task of fighting and protecting against these attacks with often nothing to gain except hurt like this:

Thank you for your service.

Security is important but the people in the security field are clowns and it seems it has gotten worse over the last 20 years.

I take full responsibility for my actions

That's not what taking responsibility means.

My contact had told me there was no embargo,

So, someone else broke the embargo and you decided to take the fall?

Nothing to apologise for.

It is not your lesson to learn. You tried to be helpful, in a way that you had no idea was verboten. Unlearning being helpful is not a good outcome of this.

It being a potentially massive security issue, taking care to make sure it is safe to release the information is definitely something that should happen, but it appears that you did this:

> My contact had told me there was no embargo, and her contact had told her the same thing.

I'm pretty sure I'd have been more cautious given that the CVE details were not minimal, as this usually implies that releasing the details is expected to cause early exploitation¹, and wouldn't have discussed it as publicly as on HN, but don't kick yourself too much for having done so. You did not break the chain, someone before you, maybe several links before you, did by telling others without giving them information about the need for an embargo.

--------

[1] Perhaps that is a lesson to learn, rather than the not being helpful one? Even then that is a small correction to your level of caution, the big lesson (“FFS be careful, things are embargoed for a reason”) is still for those before you in the chain.

This entire RCE race is always annoying.

I know breaches are often kept under wraps, and there's a long tail. But is there any evidence of impact at this point? Were any sites compromised that we know about? There was a lot of hullabaloo, with foreign and domestic LE agencies recommending sites be taken offline (holy shit!).

Was this like Y2K where, based on the coordinated action of many, a real issue was addressed in time? Or is it like Hale Bopp where everybody watched, and a few casualties in the preparation, but ultimately a nothingburger?

Flame on!

Everyone knew about the vuln well before the patches going live. The embargo, at that point, made things worse.

In plain english, please.

A reliable source has indicated an announcement is scheduled...

I have no evidence beyond "source: trust me, bro"...

In general, there's a big difference between passing a rumor among people you trust, versus posting it on a widely read public internet site.

I don't think it was a smart thing to do; but I've certainly had lapses in judgment myself.

The thing is, there was a scheduled announcement and it was coming up soon. It's not like you were a whistleblower.

Next time you find yourself with information like this, just pass it along privately.

I take full responsibility for my actions.

I would like this to materialize, but that's just empty words.

It was not remotely my intention to cause any of the subsequent side effects.

What were your intentions, then?

my intention was to alert others in a similar position to be aware of the importance/urgency of the updates.

Have you lived under the stone for the past few years with respect to cybersecurity? Yes you have. All of you ignore security as in "it doesn't apply to me", "they won't break into my software because I'm truly the best 10x developer in the world" etc.

I have learned my lesson.

I certainly doubt that. A person with IQ only a tiny bit bigger than Trump's wouldn't seek public attention so badly to disclose a security hole in a public forum.

When such praise-seeking habits have stopped being embarrassing?

Good shit

All in all, I think this leak increased the value of developers, so I am thankful for your leak.

Thanks for owning it ,the best thing now is ensuring the patch details are clear once the official release drops. Moving forward is what matters