2026-10-22 12:59 UTC
(1/5) Some thoughts on yesterday's #PHP #vulnerability
🔒 Normally, vulnerabilities are patched before we hear about them, with key distributors notified in advance to reduce risk. This time, a security researcher accidentally published details early, and a for-profit PHP distributor broke embargo and leaked the fix. The vulnerability was exploited in the wild within the hour, making everything worse.
Replies (2)
-
@jmaris@eupolicy.social 2026-10-22 12:59
(2/5) 🔎 Open Source vulnerability reporting is robust and works most of the time; you only hear about it when it fails. Speedy fixes matter, but breaking embargo puts all users at risk. If responsible disclosure is to survive, this mustn't happen again.
-
@brejoc@fosstodon.org 2026-10-23 20:27
@jmaris@eupolicy.social wasn’t this already uncovered in an audit in an 2024? Or is this something different?