Comment by nairboon 12 hours ago A bit too early for the announced coordinated release, no? 4 comments nairboon Reply cholmon 12 hours ago Their earlier comment said> We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild.https://www.php.net/archive/2026.php#2026-10-20-1 nairboon 12 hours ago Good point, at least now Debian has shipped the patched packages. kps 12 hours ago Two minutes before the announced 1400UTC? Or have I forgotten how to math? nairboon 11 hours ago More like >10min early. It's close, but given today’s speed of agents..
cholmon 12 hours ago Their earlier comment said> We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild.https://www.php.net/archive/2026.php#2026-10-20-1 nairboon 12 hours ago Good point, at least now Debian has shipped the patched packages.
kps 12 hours ago Two minutes before the announced 1400UTC? Or have I forgotten how to math? nairboon 11 hours ago More like >10min early. It's close, but given today’s speed of agents..
Their earlier comment said
> We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild.
https://www.php.net/archive/2026.php#2026-10-20-1
Good point, at least now Debian has shipped the patched packages.
Two minutes before the announced 1400UTC? Or have I forgotten how to math?
More like >10min early. It's close, but given today’s speed of agents..