On October 21, 2026, the PHP project shipped an emergency fix for PHP2Shell, two critical remote code execution bugs. The release was scheduled for Thursday, October 22. It went out on Wednesday because a Hacker News post broke the embargo on the previous Monday, a vendor publicly confirmed the bugs within hours, a researcher published a reconstruction before the patch existed, and exploitation attempts started before most administrators knew there was anything to patch.

Exposure estimates run from roughly two million hosts to more than five million depending on who is counting. The leak itself was one failure. The behavior that followed it is the one we want to talk about: the scramble among people with privileged knowledge to break news first. 

\r\n None of the scrambling should have been necessary, because the industry has spent 25 years building a process for exactly this scenario. Coordinated disclosure gives a maintainer time to fix a vulnerability before the world learns what to attack.…