By now I've seen at least 5 different people or companies blamed for leaks or releasing fixes early.
If anyone is at fault here, I'm looking at the PHP maintainers.
The embargo apparently held for like two months, during which they have not managed to release patches.
> If anyone is at fault here, I'm looking at the PHP maintainers.
There's a reason the moniker PHP was "pretty horrible programming".
And well, things haven't changed in that regard.