Why isn't Suhosin part of the PHP core?

One of the main guys behind Suhosin is Stefan Esser. Stefan seems to have had on ongoing disagreement with the PHP core developers with regard to security over the last few years. He was also one of the guys behind the month of PHP bugs which was intended to draw attention to the (in Stefan's opinion) sad state of PHP core security.

Given that the Suhosin guys have decided to go their own way and work outside the PHP project, I can imagine that:

• It's possible that Suhosin hasn't been contributed back for inclusion.
• The Suhosin guys haven't been able to convince the PHP team of it's usefulness, or haven't tried.
• The core PHP team isn't open to contributions from the guys behind Suhosin.

Some Linux distributions such as Debian (Etch and Lenny), Ubuntu and Arch include the Suhosin patch in their PHP package, so on those systems you'll often find it's turned on by default. Red Hat derived distributions (Red Hat Enterprise, CentOS, Fedora, etc) don't include Suhosin in their PHP packages.

Note: I have no association with Core PHP devs, or Suhosin, but a reasonable guess based on some of the personalities involved.

I would guess the main reasons for the php team not to include Suhosin are:

• It may break existing (badly written) php code
• It may break (badly written) php extensions (I remember Zend Optimizer being problematic)

I wonder have they contributed their code back into the main php project?

This is usually how new code gets integrated into open-source projects.