HN user petecooper, who posted the PHP RCE CVE IDs on Oct 20, apologizes, saying a contact told them there was no embargo (their account; contact unnamed). Their post said CVSS 10.0. The PHP Foundation says the leaked IDs carried a wrong time and a wrong 10.0 score (actual 9.2) and names no one. AWS logged an exploit attempt on Oct 17 and calls the actor's source of details unclear.
news.ycombinator.comTell HN: I unknowingly broke the PHP RCE embargo. I am sorry. | Hacker News