Timeline from that article:

August 19, 2026: Wiz Research discovers the first PHP vulnerability using Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol.

August 20, 2026: Unauthenticated RCE is confirmed against Drupal.

August 21, 2026: Unauthenticated RCE is confirmed against WordPress.

August 24, 2026: Wiz Research reports the vulnerabilities to the PHP security team.

September 21, 2026: PHP acknowledges the reports and begins developing a coordinated fix.

October 21, 2026: Patched PHP releases become available.

October 21, 2026: Public disclosure.

I want to understand how it leaked. I guess a whole lot of people were looped in between September 21 and October 21?

> I want to understand how it leaked. I guess a whole lot of people were looped in between September 21 and October 21?

Yes. I was at AWS when Spectre and Meltdown were discovered, and we received approximately a month of advance notice and put together teams to apply mitigations. The work of the team was on a need-to-know basis--even team members' managers only knew they were pulled onto a critical project, not what the specific project was. But there were still 30+ people in the company who knew, and that was just one company (I'm guessing Google/Azure/other cloud providers got similar advance notice).

Now, this is a much wider scale vulnerability, in the sense that Spectre/Meltdown primarily impacted cloud providers, but this attack impacts literally anyone who runs PHP. Dozens, if not hundreds, of companies likely got advance notice that a patch needed to be installed. In those companies there are teams of people applying those patches. All it takes is one of them who wants 15 minutes of internet fame to leak the details.

Two months is way too long for this, and the people involved seem to not know the "way" to do this - it shouldn't have taken a month from "reports" to "PHP acknowledges" which smells like "we sent an email or filled out a web form" when the ACTUAL reporting mechanism is "we talked to our friends at <MAJOR DISTRO> or <WORDPRESS> who called the right people and a patch is being slipped in."

> I want to understand how it leaked

If I understand correctly someone showed off a video of exploit in action - just like the ones included in article - and the visible messages were enough for other LLM users to discover the exploited bug.

> I want to understand how it leaked

I'm confused. How do you know it leaked?

It would have been nice if there had been time for downstream distributors to patch as well.

Simon, it seems you spend too much time close to the AIs and your writing is getting flagged.