Don't get me wrong, there's clearly a bug here and it really does matter. But this is not easy to exploit. It is certainly nowhere near as eay as Log4Shell/Heartbleed/RoRYaml etc.
I don't think this PHP vulnerability is that exploitable. I think that 5 years ago people would've understood this, but now people are being deluded by their LLMs telling them they have an exploit when they don't.
If you take a look at github right now, there are thousands, literally thousands, of "PoC" exploits for this vulnerability. One thing you'll notice about all of them though, is that they do not work against a vanilla PHP instance.
Go ahead, stand up a php server you think is vulnerable in Docker and then run the PoC yourself. Don't get your LLM to do it. No. Run the script, yourself. The exploits don't work.
