Can anyone explain the two month window between reporting and disclosure? I do understand Responsible Disclosure as a concept, but looking at the timeline and severity, I struggle to understand the timing.
Can anyone explain the lack of the irresponsible disclosure in the 'Responsible' disclosure timeline? The one that happened just before the coordinated release?
> We used Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol throughout this research. Notably, Gemini 4 Argon made an invaluable contribution to finding the vulnerability, exploit development, attack detection, and validation of the patch.
Grinding through abandoned source code in hopes of finding a vulnerability isn't exactly the most fulfilling work for many, perfect use case for AI which doesn't sleep.
No compute costs for finding the issue or for writing the exploit are disclosed.
But it is marketed as if it were the first RCE found in human history.
I know they waited two months with this but wouldn't it be wiser to wait just a little bit more than a few minutes after the fix released?
But also I haven’t seen much of that style of bulletin boards in ages. Maybe the occasional EEVBlog or Ars kinda count?
August 19, 2026: Wiz Research discovers the first PHP vulnerability using Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol.
August 20, 2026: Unauthenticated RCE is confirmed against Drupal.
August 21, 2026: Unauthenticated RCE is confirmed against WordPress.
August 24, 2026: Wiz Research reports the vulnerabilities to the PHP security team.
September 21, 2026: PHP acknowledges the reports and begins developing a coordinated fix.
October 21, 2026: Patched PHP releases become available.
October 21, 2026: Public disclosure.
I want to understand how it leaked. I guess a whole lot of people were looped in between September 21 and October 21?