>... Wiz, OpenAI, and Calif sat on their hands doing nothing while the vuln was being actively exploited in the wild.

What was Wiz/OpenAI supposed to do? PHP was already aware of the issue.