What Actually Happened
You're right to question the narrative.
The flaw was discovered by Wiz Research, not by "red teams" or government operatives. As far as the public record shows, the discovery was made through internal security research, not adversarial probing.
The vulnerabilities were kept confidential—that part is true. Under normal coordinated vulnerability disclosure (CVD), researchers notify the vendor, the vendor builds patches, and the details are embargoed until release.
That's the controlled process.
Then the process broke down. Details leaked on October 20—two days before the planned disclosure. The PHP team had to move the patch date forward from Thursday to Wednesday, October 21.
Was it truly "controlled" or a response to actual hackers?
It was a controlled discovery that became uncontrolled.
Here's the timeline:
Wiz Research discovered the flaws internally—likely through code analysis or “fuzzing,” which is standard security research
They followed CVD protocol—notified PHP, kept it quiet while patches were built.
The embargo was breached.
Details leaked online before release.
Exploitation began by October 17 (per Amazon)—possibly by threat actors who saw the leak, or independently found the flaws.
PHP shipped patches October 21—still a coordinated release, but under pressure.
The PHP security team said the flaws were in the session.upload_progress feature, which had been enabled by default for over a decade but was "seldom used"—suggesting it was found through traditional security research methods (fuzzing, code auditing).
The narrative of "trusted partners in a controlled operation" is partly accurate—for the initial discovery and disclosure process.
But the leak and the confirmed exploitation starting before the patch means it's an overstated characterization. The patch wasn't a clean, controlled rollout; it was a response to an early leak that exposed the vulnerability details, and a confirmed active exploitation by October 17.
So, it's more accurate to say: a responsible discovery was compromised by a leak, and the patch became a reactive emergency measure, not a fully-controlled operation.