A bit too early for the announced coordinated release, no?
Their earlier comment said
> We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild.
https://www.php.net/archive/2026.php#2026-10-20-1
Good point, at least now Debian has shipped the patched packages.
Two minutes before the announced 1400UTC? Or have I forgotten how to math?
More like >10min early. It's close, but given today’s speed of agents..
Their earlier comment said
> We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild.
https://www.php.net/archive/2026.php#2026-10-20-1
Good point, at least now Debian has shipped the patched packages.
Two minutes before the announced 1400UTC? Or have I forgotten how to math?
More like >10min early. It's close, but given today’s speed of agents..