Coordinated disclosure is breaking down in public

PHP's security release is the clearest case. Two CVE IDs leaked on forums and social media with the wrong time and a wrong 10.0 score. Then Calif, one of the firms that reported the bugs, mistakenly published a video. The thread points out that a 2024 issue was never patched either. Amazon then said it identified exploitation of PHP2Shell on Oct 17, before public disclosure, and Cloudflare's Matthew Prince reported thousands of attempts pre-announcement.

The same week, GitLab shipped a critical patch release and several Linux kernel vulnerabilities were accidentally posted to a public mailing list. Commenters joke that it's a great season for security. One suspects AI companies of staging panic to sell products. The pattern: embargoes now fail in many places at once, so the window between a bug being known and being exploited is shrinking toward zero.

Skeptics in the PHP thread say probing in server logs doesn't prove working exploits. Many botnets simply add every new CVE to their scanners. Even so, nobody disputes that people are scanning within hours.