The most dangerous moment in a vulnerability's life is not the day it becomes public. It is the days just before — when attackers hold a working exploit and defenders have nothing to install.
Wired reports that is what happened with a set of PHP vulnerabilities: exploitation began days before patches were released. The ordering matters. In that window the flaws were, in effect, zero-days in active use, and every PHP deployment on the internet — from a single virtual server running a hobby forum to shared hosting carrying thousands of customer sites — was exposed with no fix to apply.
PHP's position makes the exposure unusually broad. It still underpins a large share of the web, much of it on shared infrastructure where the person who controls the code and the person who controls the update schedule are not the same. A patch published on Monday does not mean a patch installed on Monday; distributions, control panels and hosting providers each add their own delay.
The practical lesson is not new, but it keeps being re-learned: the part of the risk curve an organisation actually controls is the interval between "fix available" and "fix installed". An inventory of the PHP versions in use, a named owner for upgrading them, and a tested rollback path do more for exposure than any amount of threat intelligence about exploits already circulating.
Wired's reporting is the account of the exploitation window; the affected versions and identifiers sit in the project's own advisory, which is the document to check against a running install.
