Php core security team decided who gets to know. The patch was huge it took that long.

See PHP foundation blog post on their timeline