alt Hacker NewsThe article takes PHP2Shell as the worst offender of the present wave of vulnerabilities but HTTP2Shell/Brotli2Shell was arguably worse. The consequence over at Brotli may very well be the same, but the timeline shows, if anything, that at least part of reality is actually still very much "humans just sitting on vulnerabilities for months or even years". From the timeline: 8 years in the code, 8 months unreleased (but fix in Git) and at least 4 independent researchers finding the problem and pointing it out.
Google also authored libwebp which contained the high severity buffer-overflow vulnerability used for the zero-click hack that made the Pegasus weaponized spyware famous worldwide for targeting journalists, human rights activists, etc.