The PHP Foundation's own timeline lists four leaks before the patch. One of them came from the firm credited with finding the flaws
2026-10-23Security
We wrote on Wednesday that the CVE identifiers leaked. The post-mortem published the same day is more specific, and worse: a proof-of-concept video from Calif, mitigation advice to critical infrastructure, and a vendor shipping the fix six hours early.