Because...that's what the PHP security team does?

No one needs to use their work, or indeed PHP at all.

But that's why the PHP security team exists.

If it takes 2 months to do fix a massive security issue, it's best if someone else steps up to the plate to fix it.

	▲	paulddraper 18 hours ago \| parent [-]
		I don’t think the parent would disagree. But the PHP team is the one that got the security disclosure.