I'm kinda sad that the PHP vulnerability happened when it happened, or that it was as big as it was. Because it kinda overshadowed the eMudhra certificate f-up, which is a much more interesting security incident if you ask me.

Don't get me wrong; all security incidents are important and interesting, and I wish that none of this had happened and I'm sending virtual support hugs to everyone managing this. But you have to admit that the PHP vuln was a... pretty standard one. Some old C code that had a bug in memory management, nobody noticed, then it was discovered with AI. Tale as old as time (given time = 1–2 years); almost every project has to deal with stuff like this.

Whereas the eMudhra certificate story is incredibly curious. An HSM producing single-byte private keys? Mozilla "detecting" it, causing legitimate keys to be rolled back? Sudden realization that every other piece of software vendors and bundles CA roots? How fun is that!?