Blogger Elias Taylor says public PHP2Shell PoCs fail on vanilla PHP and lean on a file-inclusion bug the target must already have. The top-starred PoC repo's README lists such app-side conditions for chain A and says code for chains D and E is for paid subscribers. PHP's advisory still says RCE was validated against default mod_php (attack complexity high), and Datadog says it reproduced both flaws.
Elias TaylorThere isn't an easy exploit for this PHP vulnerabilityMass hysteria, or something.