The PHP developers didn't find these bugs, Stefan Esser did. (see http://php-security.org/)

The fact that one of the bugs still remains from his original /2007/ Month of PHP Bugs shows that the PHP developers are clearly not doing a thorough job.

From the credits list: "Protocase for putting up with hundreds of small 3-D case design tweaks", which I assume is http://www.protocase.com/.

From the forum thread at CoreAVC discussing this, the founder of CoreAVC says "Again without going into all the details... this is mostly about reverse engineering without permission under the DMCA... by us giving Alan permission.... problem solved".

Without seeing the coreavc-for-linux code I can't say whether or not he had to reverse engineer anything about CoreAVC to get it working, but it doesn't seem like hooking up a DirectShow filter via a (relatively) standardized API would need anything like that. Since this claim was made under the DMCA, he would have had to be reverse engineering something related to copy protection. Perhaps there is some sort of product activation that had to be hacked around to get the codec working on a non-windows platform?

Today:
HP = computers and printers
Agilent = Test and measurement
Original HP = Agilent