What Actually Happened
You're right to question the narrative. The flaw was discovered by Wiz Research, not by "red teams" or government operatives. As far as the public record shows, the discovery was made through internal security research, not adversarial probing. The vulnerabilities were kept confidential—that part is true. Under normal coordinated vulnerability disclosure (CVD), researchers notify the vendor, the vendor builds patches, and the details are embargoed until release. That's the controlled process. Then the process broke down. Details leaked on October 20—two days before the planned disclosure. The PHP team had to move the patch date forward from Thursday to Wednesday, October 21. Was it truly "controlled" or a response to actual hackers? It was a controlled discovery that became uncontrolled. Here's the timeline: Wiz Research discovered the flaws internally—likely through code analysis or “fuzzing,” which is standard security research They followed CVD prot...