Cyber-security incident involving PHP and responsible disclosure practices

Puzzling to me that researchers operating in cyber-security appear not to have followed responsible disclosure practices.

Seems certain details of the vulnerability were publicly disclosed after researchers “mistakenly published a video” [1] and “details of the flaw leaked on social media on Tuesday” [2]. PHP Foundation had intended to release details of the vulnerability, along with a complete fix, later this month [2].

Interesting to consider the extent to which researchers and their organisations can, and should, be held responsible for the disruption caused by non-adherence to responsible disclosure practices.

Given the scale of disruption caused to public sector and private sector organisations around the world (and to individuals who rely on their products and services), more robust definition, monitoring and enforcement of responsible disclosure practices by organisations, communities and governments seems very worthwhile.

Read the BBC’s live reporting of the incident at: [1] “Global scramble to fix critical cyber-security flaws as many websites taken offline”, BBC News. https://www.bbc.co.uk/news/live/ckgel5xp2xv9t

Read the BBC’s article on the incident at: [2] “UK working to identify exposure after global cyber-security warning”, BBC News. https://www.bbc.co.uk/news/articles/cmx23d0k57d3o

Read the announcement from the National Cyber Security Centre (NCSC) in the United Kingdom at: https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php