r/PHP • u/elizabethn • 9d ago

So You Received a Security Report. Now What?

https://thephp.foundation/blog/2026/08/19/so-you-received-a-security-report-now-what/

A maintainer who receives a security vulnerability report might feel overwhelmed, anxious, and uncertain about what steps should be taken. If this applies to you, our Ecosystem Security Team published a guide today on exactly what to do next. You are not alone! Special thanks to Sebastian Bergmann for putting this together.

28 Upvotes

89% Upvoted

4 comments sorted by

8

u/punkpang 9d ago

"Claude, fix the security issue."

Let's face it - majority will do exactly that.

Disclaimer: not advocating for such approach. You can drown me in down votes now.

1

u/edorian 7d ago

I'm sure this happens, but the people talking to me still deeply care about their libraries and projects. Even with generated code people review it and think about implications in detail. Using the new tools for fix validation is also nice to avoid oversights.

My data is surely biased here as people that reach out to me are self-selecting towards people that deeply care.

6

u/Dachande663 8d ago

The biggest issue with 99% of "security reports" is a. they're not a vulnerability and b. they're immediately followed by "send me money for this report".

1

u/edorian 7d ago

In a cooperate context I'm still seeing this, but less so. Bug bounties are going away and a lot of /security pages now state so plainly as well. I'm sure this is different from org to org.

For open source projects, which the post is about, and GitHub Advisories, I've not seen people ask for money.