Seems like itt was possible to hide it so well due to an oversight in the API for preg_replace. In-band signaling in general makes it easy for people to acciden

Seems like itt was possible to hide it so well due to an oversight in the API for preg_replace. In-band signaling in general makes it easy for people to accidentally add security holes. What they should have done is pass the regex options as a separate parameter, then it would have been obvious that something fishy was going on here.