# Vulnerability disclosure: Which comes first, the security bug in PHP or the CVE?

DevFeed: [Vulnerability disclosure: Which comes first, the security bug in PHP or the CVE?](<https://devfeed.tech/articles/vulnerability-disclosure-which-comes-first-the-security-bug-in-php-or-the-cve-8227.md>)

Original publisher: [Read original article](<https://snyk.io/blog/vulnerability-disclosure-php-use-after-free/>)

Author: Liran Tal; DeveloperSteve Coochin

Published: 2023-12-19T06:00:00Z

Content type: article

Language: en

Sources: [Blog RSS Feed | Snyk](<https://devfeed.tech/sources/blog-rss-feed-snyk.md>)

Topics: [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>), [PHP](<https://devfeed.tech/topics/php.md>), [Security](<https://devfeed.tech/topics/security.md>), [bug](<https://devfeed.tech/topics/bug.md>), [Open Source](<https://devfeed.tech/topics/open-source.md>), [Maintainers](<https://devfeed.tech/topics/maintainers.md>)

Tags: [application-security](<https://devfeed.tech/tags/application-security.md>), [awareness](<https://devfeed.tech/tags/awareness.md>), [blog](<https://devfeed.tech/tags/blog.md>), [bug](<https://devfeed.tech/tags/bug.md>), [cve](<https://devfeed.tech/tags/cve.md>), [cve-reporting](<https://devfeed.tech/tags/cve-reporting.md>), [devrel](<https://devfeed.tech/tags/devrel.md>), [incident](<https://devfeed.tech/tags/incident.md>), [maintainers](<https://devfeed.tech/tags/maintainers.md>), [open-source](<https://devfeed.tech/tags/open-source.md>), [php](<https://devfeed.tech/tags/php.md>), [report](<https://devfeed.tech/tags/report.md>), [security](<https://devfeed.tech/tags/security.md>), [security-vulnerabilities](<https://devfeed.tech/tags/security-vulnerabilities.md>), [snyk](<https://devfeed.tech/tags/snyk.md>), [vulnerability](<https://devfeed.tech/tags/vulnerability.md>), [vulnerability-disclosure](<https://devfeed.tech/tags/vulnerability-disclosure.md>)

## AI overview

This article examines the disclosure of a PHP Use After Free vulnerability and the difficulties of getting security reports recognized, fixed, and published as CVEs. It follows the dompdf incident timeline, including delayed maintainer responses, public disclosure, exploitation leading to a reverse shell, and the eventual CVE assignment.

## Source excerpt

In this post, we cover the CVE reporting process using the Use After Free vulnerability type as an example.