Skip to content

Back to the catalog

akamai.comarticle

TLP Is Not a Suggestion

Akamai SIG argues that vendors and researchers broke embargo norms during the October 2026 PHP2Shell leak, when the PHP fix shipped a day early on 21 October. It explains the four TLP 2.0 labels, tabulates past embargo breaks (Heartbleed, a collapsed six-month kernel-era embargo, the Alibaba Cloud and MIIT case), and lists seven practices, such as no proofs of concept or CVE numbers before the fix.

TL;DR Argues that the PHP2Shell leak showed vendors racing to publish, and sets out TLP-based embargo rules for responders.
Open original ↗

Organisations named here

  • Alibaba Cloud
  • CERT-EU
  • CVE.org
  • FIRST
  • Heartbleed
  • MAPP
  • MIIT
  • oss-security
  • TLP:AMBER
  • Traffic Light Protocol

CVEs named here

  • CVE-2026-111497

Technologies named here

  • Node.js
  • PHP
  • Cloudflare
  • Red Hat
  • Coordinated disclosure
  • CVE.org / CNA
  • Embargo lists and trust groups
  • FIRST (Forum of Incident Response and Security Teams)
  • MAPP (Microsoft Active Protections Program)
  • oss-security (Openwall)
  • PHP 5 and above (PHP2Shell, two critical remote code execution bugs; emergency fix shipped October 21, 2026, ahead of the scheduled October 22 release)
  • Traffic Light Protocol (TLP)

Techniques named here

  • Coordinated vulnerability disclosure
  • Embargo breaking (leak)
  • Proof-of-concept or exploit reconstruction before a fix
  • Virtual patching

Threat actors named here

  • PHP2Shell

Related in other