“Any attacker could now study the fix in binary form while every other PHP user was still waiting for the release.”
Two unauthenticated remote code execution bugs in the language under a huge share of the web. The fix sat stalled for months, and the foundation calls that a structural failure. Then the CVE IDs leaked and Chainguard shipped patched images six hours early. The “strengthening security” headline is a press release stapled to a confession.