The PHP foundation has a lot to say about how this all went down, including the period of discovery, fixing, and the leak: https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-ho... The leaking happened in stages Tuesday. Three most notable moments: * first folks were just saying that high severity PHP flaw was coming down the pipe, the CVE identifiers were blogged, scores (correct and wrong) were given * around 2:30pm Winnipeg time the PHP foundation made a pre-annoucement and moved up their release time to Wednesday morning (Winnipeg time) * around 3pm Winnipeg time the security firm Calif which had a key role in the discovery published their video on X "mistakenly". They pulled it down but the internet does not forget and started re-posting. (by evening even I was using a Google Drive link to re-post it). This can now be found embedded in their post https://calif.io/php2shell/ . Was pretty weird with all the dancing anime and blur effects going on, folks could have easily gone down the rabbit hole of asking if it was real... though by that point the PHP foundation had already told folks the sky was falling. Charitable explanation is that they felt there was enough out there already that they could start bragging and then realized they were saying too much (more details than PHP Foundation) and so they yanked the post. I've gone into less charitable, speculative explanations elsewhere, though none of them involve money... On balance, I'm more grateful for the work the Calif folks did in the responsible research and disclosure pipeline which took months of work than upset by their incremental indiscretion in the final day. It seems there were a lot of pretty tight lips until the nearly the end of the runway. This vulnerability was just a little too big to have a perfect embargo, way too many "critical" people had to be given advance notice and so way too many people were in the know prior to Tuesday. Mark Jenkins