Vulnerability disclosure: Which comes first, the security bug in PHP or the CVE?

In this post, we cover the CVE reporting process using the Use After Free vulnerability type as an example.