Vulnerability disclosure: Which comes first, the security bug in PHP or the CVE?

For security researchers, there is a series of hurdles in raising a potential vulnerability well before the issue itself is widely recognized. Convincing the project maintainers that there is an issue becomes the first hurdle, even with a working exa...