PHP2Shell leak forced an emergency patch a day early, and the scramble to break news first made it worse
TLP Is Not a Suggestion
When a Hacker News post broke the embargo on the PHP2Shell remote code execution bugs, PHP shipped its emergency fix a day early, a vendor confirmed the flaws within hours, and a researcher published a reconstruction before the patch existed. Akamai's Security Intelligence Group argues the real failure was the rush among insiders to break the news first, violating the Traffic Light Protocol that has coordinated vulnerability disclosure since 1999.
The protocol only works among people who want it to work, and it fails the moment a participant decides their standing in the market matters more than their standing in the community.