First, thanks to everyone who spent 2 months working on this vulnerability, developing the patch, and coordinating the disclosure. The effort is appreciated.

That said, I think the incident highlights a serious flaw in how we handle vulnerability disclosures. Many operators were left with little practical choice but to disable PHP or accept the risk while waiting for the technical details and patch. The frustrating part is that there were configuration changes in php.ini that could help mitigate the exploit, yet this guidance was not provided ahead of the public disclosure and patch release. I'm not suggesting that the vulnerability details or exploit instructions should have been released earlier. I'm saying that mitigation guidance should have been.

The current process is missing a step.…