The recent PHP crisis shows that faster vulnerability discovery needs investment in maintenance, disclosure, and deployment.