What's the other choice? OpenAI et al could have developed a patch (for all we know they did) but you need the PHP team's participation to get it out. The alternative would be to fork the project and put up a forked release with the fix, which would have been incredibly disruptive.

▲

theboblong 3 hours ago | parent [-]

I'm glad they didn't do anything disruptive, then. Like wind the world's CIOs up into a frenzy of FUD and bring thousands of servers down in a coordinated panic attack synchronised to the minute.

Imagine if they had just patched the code and rolled it out with an advisory?! Oh my GOD! Won't someone think of Sam Altman and his huge pile of debt?!

	▲	aDyslecticCrow an hour ago \| parent [-]
		Pre AI, silently publishing a fix to a security vulnerability was considered bad practice. Post AI, Its efficiency pre announcing the exploit to bad actors until the official disclosure. You can just watch the diff log of every open source project with a small local model, and look for anything that touches buffers, function pointers, or shell integration. It could be an hour between release of a fix before the exploit starts attacking servers. Guess what also could happen within an hour? A coordinated Internet wide panic that shuts down all vulnerable servers. --- We actually have a recent example. OpenAI hack. An undisclosed vulnerability fix to a image formal lib; packages into debian 12 running in a docker, used by imagemagic, used by discourse running OpenAIs user forum.