There is no functional difference between doing just an announcement and doing an announcement with a series of builds containing the patch while withholding the source code. You do understand that right?

▲

Dylan16807 an hour ago | parent | next [-]

A message as vague as "there is a major RCE somewhere in this entire programming language" is usually pretty safe. We'll see how the details actually got out in this situation and whether the announcement caused it, but it still took a while. If you put out a patched build people will find and decompile the changes nearly instantly.

	▲	janmo 42 minutes ago \| parent [-]
		They gave too many details just by saying that it affects PHP 5 and later and is an RCE CVSSv4 9.2 This lets an AI agent look at the changes made from PHP 4 to PHP 5 and it also lets the agent guess what type of vulnerability it must be.

▲

Numerlor an hour ago | parent | prev [-]

A patched build is strictly more information, and you'd only need to cross correlate between the two.

At this point shipping the build already may have been the best option but not necessarily everyone is actually able to ship yet. And this is of course assuming the actual vulnerability is the same one as the PoCs that are being tried, and not something even nastier instead