PHP2Shell was supposed to be a SECRET... The person who posted an early warning about the PHP flaws has apologised, saying he didn't know it was confidential. "I unknowingly broke the PHP RCE embargo. I am sorry." The plan was to announce the flaws alongside fixes, so website operators could protect their systems. But information got out early. On Oct 20, "petecooper", a freelance consultant, posted on Hacker News that two serious PHP flaws would soon be announced. He says his contact had told him there was no restriction on sharing it. "My intention was to alert others of the importance/urgency of the updates," he added. Instead, his warning disrupted the coordinated release. PHP brought its emergency updates forward to Oct 21, ahead of the planned Oct 22 announcement. But, it was too late. Videos demonstrating how to exploit the flaws have already spread online. Cloudflare reported MILLIONS of attempts to exploit the flaws within hours of disclosure. Hundreds of websites and apps have gone offline as operators responded. Petecooper returned to Hacker News, saying he never intended "any of the subsequent side effects." “I am truly sorry. I take full responsibility for my actions.”