I don’t think the parent would disagree.

But the PHP team is the one that got the security disclosure.