IluTov

We checked them as claims came in to decide whether early disclosure was necessary. There were no reports of successful attacks, these were early and naive attempts. Furthermore, we were still waiting for distros to finish their builds and early disclosure might have helped aid in development of exploits as people were wanting.

Of course, we are not omniscient and cannot prove definitively nothing happened, but we acted based on the data that was available at the time.

This is absolutely not true. There are several things that leaked:

- The fact that there's a release, the CVE numbers, CVSS score and date/time (though wrong).

- Calif's video.

- Some advice from the mitigation document.

Despite this, the technical details of the vulnerability remained unclear, and exploits released up to that point missed the key mechanisms. Chainguard acted based on rumors and almost made the situation much worse for everyone.

> A primary use case for hooks is actually to not use them, but retain the ability to do so in the future, should it become necessary.

My personal motivation was always to finally put an end to the getters/setters boilerplate.

It's not possible because PHP has a LALR(1) parser but this would require arbitrary lookahead.