github.com/ACD421/PHP Sooooo many vulns @J4ck3LSyN @Archknight23 This is a credit theft attempt dressed up as process. I found the bug. I put the work on a public GitHub. PHP security wrote me back and @IlijaTovilo admitted the PoC is based on my finding. Then he said the person who refiled it through security@ / GHSA "will get the credit … because that's how it works." That is a lie about CVE rules. CVE CNA Operational Rules §5.2.4: credits are optional (MAY). Nothing says the inbox refiler gets finder credit and the person who identified the vulnerability is erased. The CVE Record Format separates finder (identifies the vulnerability) from reporter (notifies the vendor/CNA). Those are different roles. CVE-2026-115560 is still Reserved. The record is not published yet. They are deciding credit now, in email, against their own admission. Same thread, he accused me of "potentially 0-daying the entire world" and "giving the recipe to every person on the planet." Then he moves to strip finder credit from the person whose work he just admitted using. Video is the full chain. Watch it. Do not take my word. Take theirs. We won't get credit. We won't get thanked. We won't get paid. PHP has been lying to you all and its time we hold them accountable. Stop using PHP. Find something new. Get rid of tech debt and bad security teams. @WIRED @TechCrunch @DarkReading @SecurityWeek @motherboard @KimZetter @josephmenn @MITREcorp @TheRecord_Media @IlijaTovilo @ThePHPF @official_php @CVEnew @CISAgov @TheHackersNews @arstechnica @briankrebs @BleepinComputer @troyhunt @SwiftOnSecurity @campuscodi @TheRegister @Girgias #CVE #CVE2026115560 #PHP #PHPsec #OffSec #FullDisclosure #PublicDisclosure #HackThePlanet #BugBounty #InfoSec #CyberSecurity #SecurityResearch #CreditWhereItsDue #OpenSourceSecurity #GitHub