The idea is that nobody has chance to have prior knowledge to identify or research the bug until it is generally possible to apply the fix immediately. If someone leaks the patch beforehand, others can inspect the bug and start exploiting it in the wild, while others have no chance to apply the patch.

Whether someone just leaked the CVE numbers or just ”there is a big bug in PHP” - that should not be enought to accelerate finding that bug. But other information that pins the bug for specific property or feature makes it easier to find and race against patching starts.

And at that point you don’t really know if someone really found it or not, since only few big organisations can collect that much data to detect successful exploiting. And most ”PoC”:s in the wild were credible-looking but vibecoded mess that did nothing what sources claimed.

Until there is absolute evidence that exploitation happens in the wild, succesfully, you don’t leak the patch or bug details beforehand.

In this case, the area where the bug is in PHP, leaked partially, but apparently there was no enough evidence that it was exploited succesfully or if any of the PoCs in the wild actually worked properly. So patch or related detailed information was not released before the initial schedule.