The release should've been done sooner once it was clear the embargo was broken and people figured out the vulnerability.

Some issues covered here: https://thephp.foundation/blog/2026/10/21/todays-php-securit...

More proactive outreach and better coordination with key downstreams.