If it takes 2 months to do fix a massive security issue, it's best if someone else steps up to the plate to fix it.

I don’t think the parent would disagree.

But the PHP team is the one that got the security disclosure.