A Hacker News user apologized for posting the CVE identifiers for the critical PHP2Shell vulnerabilities on Oct 20, two days ahead of their planned Oct 22 release, saying a contact told him the flaws were not under embargo. As the identifiers spread online and security firm Calif accidentally posted an exploit video that evening, the PHP Foundation moved its security release up a day to Oct 21 at 14:00 UTC.
Former Department of Energy security engineer @asynchronous_x said the miscommunication turned a coordinated fix into a “panic race” and showed the security industry “probably can’t rely on coordinated disclosure anymore” as AI accelerates exploit development and narrows the gap between junior hackers and agencies like the NSA. Kong CEO Augusto Marietti also warned that models are giving attackers nation-state capabilities while companies deploy AI agents with non-deterministic attack surfaces they have not secured.
The embargo had already fractured before the Hacker News post, with Amazon Web Services detecting an exploit attempt against its MadPot honeypots on Oct 17 from a commercial anonymization network. On Oct 21, container security firm Chainguard published patched images at 07:41 UTC, more than six hours ahead of the rescheduled release; CEO Dan Lorenc apologized for the added stress on maintainers after saying several vendors had reported wild exploitation. Cloudflare CEO Matthew Prince said exploit attempts on its network rose from thousands in the 10 hours before disclosure to millions afterward, though Trail of Bits noted that while it built a working exploit against MediaWiki, large language models struggle with the manual memory tinkering required under normal traffic. About 1.5 million of 2.6 million identified PHP servers run end-of-life versions below 8.2 that received no official patch, according to Censys.