if you received the information about the RCEs without the information about the embargo, then you did not break the embargo. someone else up the chain did.
this whole saga will be analyzed and we'll all come out better for it at the end.
this whole saga will be analyzed and we'll all come out better for it at the end.
Doesn't responsible disclosure also apply? If I become aware of a vulnerability that doesn't seem to be widely known shouldn't I first attempt to report the issue responsibly?
In this case it appears the OP did know about the embargo "A reliable source has indicated an announcement is scheduled". I think that with security disclosures it is assumed they are not supposed to be publicized before the announcement, but if he hadn't known about the announcement and only heard about the RCEs, then publicly announcing their existence doesn't seem OK either.
This term came from an era where companies or projects were disrespectful and dismissive towards security researchers. Those orgs were generally bad risk practitioners, and they coined the term "responsible disclosure" to mean "you send us the info and we'll do whatever we want with it, for however long we want, etc".
Many security people (like me) prefer the term "coordinated disclosure" as a way to indicate a practice where both discoverer and patcher participate in a good faith, communicative, and timely process to get things fixed for the community.
The difference can be summed up like this: if I report vulnerability X to company Y, and company Y sits on it for 3 years, that is not responsible. It is more "responsible" (especially today) to report it to the public, so they can protect themselves in a non-official-patch way, because the likelihood of bad guys knowing about it and exploiting it are approaching near-certainty.
These terms are obviously not super scientific, but I try to point out the history whenever it comes up.
Renaming "responsible disclosure" to "coordinated disclosure" seems to have the same flaw, since a lazy company involved in coordinated disclosure might look more committed than it really is. The focus should be in the process and not the names.
Responsible disclosure puts the responsibility onto the researcher - it implies they're irresponsible if they didn't comply with the company's timeframe.
Coordinated disclosure accurately describes what _should_ happen - the disclosure happens after some X time (where X is a reasonable time that depends on the vulnerability, as determined by the researcher).
It's still completely responsible and ethical of a researcher to disclose an unpatched vulnerability even if the company/project doesn't want to, if they've unreasonably delayed patching. They'd never do it otherwise, and the public deserves to know those internal practices.
I feel this is a similar argument as the one about capitalizing "Internet", though.
Did they assume the information came from upstream php? I think if i got a new version of php that i thought was coming from official sources, i would assume there is nothing to responsibly disclose.
What did happen is that a whole bunch of people had no clue and called the fact that "these 2 CVE IDs will be used for a PHP vulnerability" a CVE leak. Posts were going around yelling "CVE leak!" with a CVE database link that said "no information yet". Part of this is the mushed usage of "CVE" to just mean "vulnerability" rather than "CVE record". But still, quite ridiculous, and annoying. Information that CVE ID XYZ will be used for project ABC is *not* a leak. Like you say, CVE publishing matters. Getting the CVE record contents would be a leak.
For example: https://www.cve.org/CVERecord?id=CVE-2026-50000
Assigning the CVE happens much earlier than actually publishing, but it's the latter that ends the embargo.
Consider this example:
https://www.cve.org/CVERecord?id=CVE-2026-113119
At this time, the corresponding Chromium bug tracker entry is still private:
https://issues.chromium.org/issues/557075191
(I just picked this one at random, I haven't checked if the information is publicly available from another source.)
the embargo was already broken when pete received the information.
For the law, you can say that the law has been published and is at least available for review.