I imagine more details will come out over the coming days, but it’s not uncommon for severity to be under-estimated in the beginning; and then “oh shit” as you dig deeper.

We don’t know when it went from a “memory safety issue” to “php2shell/RCE”.

Calif’s report is a little light on timelines, but reading between the lines, it seems they took a while to turn this into an actually exploitable vulnerability.

Finally, at least pre-LLM (and maybe a bit outdated now), responsible security disclosure norms is that you usually do wait for vendor (up to 90d) if there’s no signs of active exploitation. Even if it’s a RCE. Actually, especially if it’s a RCE.

The last thing you wanna do is go pinging random non-security PHP contributors or maintainers and have it leak with zero patch. That is truly the worst outcome.

Yes, this is bad, but also, it’s apparently been bad for decades; and it could’ve been much worse.

>This really sounds to me like "they filled out some webform" or "sent an email to security@php that read like any of the ten billion we found vulnerability in your code please send money emails

i highly doubt it. these are pretty big names in the security sector who have plenty of experience reporting high severity vulns.

I've said elsewhere I am sick to death of reading AI written "security disclosures". Even for genuine issues, it just saps my motivation to fix them.

That said, PHP team handled this poorly. How does letting everyone know so they can "prepare" help anyone at all. It just creates panic.

Are you victim blaming the reporter?

If you have a bad process, fix the process.