Comment by jopicornell

I have a lot of sympathy for the PHP team as well, I hope it doesn't sound like it.

A lot of speculated info was right: the mitigations were mostly right, the video showing exploitation was real and the release of a fixed image was real.

I think if you do a pre-announce, and you say that you could release it earlier or release new information and you don't, and there are reasons to inform your users, then even if it's the middle of the night for you, you should.

As they stated, they are a small team and they have changed their structure, and they are learning and improving. I think if something like this happens, info is vital for us, the administrators of PHP servers