She says the full-time member is herself, and looking at her Linkedin (in/elizabethn) she isn't exactly the person who would patch PHP for the two CVEs.