HN user petecooper, who posted the PHP RCE CVE IDs on Oct 20, apologizes, saying a contact told them there was no embargo (their account; contact unnamed). Their post said CVSS 10.0. The PHP Foundation says the leaked IDs carried a wrong time and a wrong 10.0 score (actual 9.2) and names no one. AWS logged an exploit attempt on Oct 17 and calls the actor's source of details unclear. https://news.ycombinator.com/item?id=50193416 #PHP2Shell #PHP #InfoSec #Cybersecurity