@Crell @happyborg Sloppiness in one regard often correlates with sloppiness in another.

Perl, for example, has had taint mode for over 2 decades. If I look at PHP best practices *today* it tells me to please sanitise my inputs, no enforcement at all. It's a fundamentally different approach to security.

As I wrote, I haven't yet analysed the current problem myself, but from what I've seen from others' analyses, it seems that the patch is not great, and that the underlying design isn't either.