[leigh_t]

> due to a vulnerability in the extract() command

No.

This is due to insane usage of the extract() function. Not a vulnerability with the function itself.

You can pass user-supplied input directly to plenty of other functions which have equally idiotic outcomes, it doesn't mean that they have vulnerabilities, it means the author is a liability.

[mandatory]

Right, didn't mean that in the original post - obviously this is how the function is designed to work. Fixed up the wording to clarify.