On: Tell HN: 2x PHP RCE CVEs with CVSS 10.0 Incoming

Deciding to announce it like this is wild, it's an invitation for everyone to put their agents to work in order to find out what the vulnerability is and exploit it, while nobody is allowed to patch it until tomorrow.

It's already been found and shared on X. It's only a matter of hours before untold numbers of sites are hacked.

exactly, that's why in my opinion the patches should have been made available straight away instead of doing this, it made it worse.

It was leaked

Where?

Here

https://news.ycombinator.com/item?id=50167754

I don't see any details of the vulnerability leaked except "code execution"...?

It got flagged already, can't see it.

Whew! Imagine if the details were documented in the clear on HN for anyone to see.

(We've since merged the threads)