Reports arrive with a reproducer, a bisected culprit commit and a candidate patch, and nobody reviewed them first.
PHP2Shell drew millions of attack attempts within hours, and the vulnerabilities behind it were already known to maintainers…
After letting agents write security fixes, the firm audited what it had merged and confirmed 21 regressions across…