I've been following PHP2Shell, and while there's a lot of discussion about AI-assisted vulnerability discovery, I'm more interested in what happened around the fixes.

The PHP Foundation describes the technical and organisational difficulties involved, including limited resources, decision-making problems, and a dependence on a small number of people with deep knowledge of PHP's internals.