> As far as anyone is aware, disaster has been averted: The hack was discovered by cybersecurity researchers who reported it to the PHP Foundation
Thanks to The Lord everytime someone discovers the vulnerability he reports it right to the owners/maintainers and there are no bad actors out there keeping it as secret and using for years.
It is observer bias... Everyone reported it the proper way, for all the cases we know of.
Maybe you were sarcastic, then forgive me my denseness.