given, you know, we knows php considers it a cvss4 9.2 ...