So anybody can just push out a new release of PHP?
Yes, someone could have published a safe version for people to use for the 2 months to get the actual fix done.
Sort of by definition of open-source, yes. It's just that nobody downstream is likely to accept Joe Public's random fork of PHP.
Yes, someone could have published a safe version for people to use for the 2 months to get the actual fix done.