> Doesn't responsible disclosure also apply? If I become aware of a vulnerability that doesn't seem to be widely known shouldn't I first attempt to report the issue responsibly?

Did they assume the information came from upstream php? I think if i got a new version of php that i thought was coming from official sources, i would assume there is nothing to responsibly disclose.