PHP

Four parties found the same PHP memory-corruption root cause between August and October. The embargo still came apart two days early, and the maintainers spent 71 days deciding on a fix, not finding one.