Thanks to PHP for releasing details of the OMFG CVSS 10 vuln 15 minutes before they said so, and before the major package managers have a patch available. Is this to make it a bit of sport?