PHP's 9.2 RCE fix was public for three days before the release. I read all 11,747 lines of it.

PHP announced two 9.2 RCEs with no details on Oct 20. The fix — one commit, 300 files, +10,759/−988, 196 new OOM tests — had been public on php-src since Oct 18. I read it, counted it, and timed the disclosure: NVD records landed at 14:17 UTC, 17 minutes after the release.