Comment by tetraodonpuffer

surprising it took nearly a month to acknowledge the bug

August 24, 2026: Wiz Research reports the vulnerabilities to the PHP security team.

September 21, 2026: PHP acknowledges the reports and begins developing a coordinated fix.