I was reading the official statement from The PHP Foundation on the recent vulnerability disclosure, and one part stood out. The statement noted that: In 2024, PHP underwent its first external security audit in years. The PHP Foundation secured funding from the Sovereign Tech Agency to organize this audit through OSTIF, and it was carried out by Quarkslab. While fixing one of the issues Quarkslab reported, a PHP core developer contracted by the PHP Foundation found the first signs of the OOM problem behind CVE-2026-109618. In 2024, a potential exploit for the OOM problem was theorized, but no concrete vectors were found and other concrete issues with clear impact overshadowed these concerns. What I find particularly interesting is that this issue was theorised during the remediation of an external security audit nearly two years ago. The possibility of exploitation was recognised, but it was ultimately deprioritised because nobody could identify a credible attack path. Two immediate takeaways come to mind: How many vulnerabilities do we collectively theorise, only for them to be deprioritised because developers cannot see a practical way to exploit them? The act of theorising a vulnerability may only require understanding a handful of files or functions. Identifying a concrete attack vector is a very different challenge. It often requires tracing complex interactions across a large codebase and building a deep understanding of how seemingly unrelated components behave together. As codebases continue to grow, that task becomes increasingly difficult for humans.