The PHP security release write-up is a good read and confirms most of my hunches about the issue:

- The issue was hypothesized for at least 2y.
- Multiple teams reported the issue (it wasn't ignored for a month like Wiz Research claimed).
- The fix was in progress for 2mo after reports in Aug.
- There are so many LLM security reports the team is overwhelmed.

https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/