The release should've been done sooner once it was clear the embargo was broken and people figured out the vulnerability.

More proactive outreach and better coordination with key downstreams.

Some issues covered here: https://thephp.foundation/blog/2026/10/21/todays-php-securit...