PHP2SHELL: THE LEAK IS NOISE, THE TWO-YEAR STALL IS THE STORY
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two 9.2 RCEs in the interpreter itself. The Foundation's own postmortem says the root cause was found in 2024 and the fix stalled for two years, which matters more than the embargo that broke.