>OpenAI and these security companies sat on this for 2 months

these security companies reported it 2 months ago. it took a month for the php security team to acknowledge it and another month for the php team to develop & release the patch.

if you're going to be upset at anyone it should not be the reporters.

>The official interim fix for php8.5 [1] could have been published 24h ago, or even 2 weeks ago, without revealing any security details.

publishing the fix = publishing the security details.

One concern with the current environment is that as soon as a release comes out for such an important open source project, people will immediately point bots at the release to look for changes that might be related to existing security issues. This means that putting out a quick out-of-band release is guaranteed to result in people racing to exploit the problem before many even know there is an update out.

Whether keeping the update quiet and including it in the next normal release, where there are more trees obscuring the wood that is the security concern, and announcing the bug a short time later once anyone using distro updates or otherwise keeping on top of things have updated, would be safer overall than what has happened today is up for debate. I can think of arguments in both directions.

--------

[1] which does have a slight whiff of AI marketing about it - would a human-found issue, without the option of a big AI company to claim some credit, have been handled differently?

It's not possible to publish a security patch for an open source software report without revealing security details anymore (and as of the past couple weeks I would not count on being able to do that for closed source binaries either). The moment you push publish everyone knows previous versions are compromised

“OpenAI and these security companies sat on this for 2 months”

I don’t think this what happened at all, and even less so to specifically call out OpenAI.

The issue was discovered using their model, it was disclosed, and the PHP team took months to address it. Eventually it leaked.

This is a process / people failure that does not involve the people responsible for discovering it.

You can't do secret releases, people will figure out what you added or changed.

But they could have accelerated the patch release once the embargo was broken and rumors of a PoC started going around. There was no need to wait 12+h today until the release.

Maybe the NSA ‘requested’ some time to use the exploit on some high value targets.

Sure, it’s PHP, but plenty of companies or organisations might have some PHP running somewhere; and once you’re in, lateral movement becomes a lot easier.

Php core security team decided who gets to know. The patch was huge it took that long.

See PHP foundation blog post on their timeline

> OpenAI and these security companies sat on this for 2 months

The PHP team knew about it since September 21st.

Maximizing the PR value...

And then they proceeded to cripple any of my agents working on this.

> OpenAI and these security companies sat on this for 2 months, decided for themselves who gets access to an early fix

Amazingly, AWS Linux has not been patched yet.

Of course it was OAI that decided those things, not the U.S. Government