I don't think the OP did anything wrong. Even if they posted LESS information, they would still be ethically correct to post that: "I am party to details about the PHP RCE CVEs, and I shouldn't be. The embargo has already been broken", or WTTE.

Because I guarantee that if the OP had access to this information, this embargo has leaked more broadly, and people without any ethical qualms about it have exploited that leakage.