upvote
Their earlier comment said

> We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild.

https://www.php.net/archive/2026.php#2026-10-20-1

reply
Good point, at least now Debian has shipped the patched packages.
reply
Two minutes before the announced 1400UTC? Or have I forgotten how to math?
reply
More like >10min early. It's close, but given today’s speed of agents..
reply