Simon Willison's report, quoting the PHP Foundation, says the vulnerabilities carry a CVSS score of 9.2, not the 10.0 score that circulated in early posts.
The CVE identifiers began circulating on forums and social media at about 15:00 UTC on October 20. PHP moved its pre-announcement to 19:30 UTC that day and advanced the release from October 22 at 14:00 UTC to October 21 at 14:00 UTC. The report says a security firm's mistakenly published video showed a proof of concept against several targets; copies then circulated and contributed to further PoC development.
Wiz Research says it discovered the first issue on August 19 using Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol, and later confirmed unauthenticated RCE against Drupal and WordPress. It reported the issues to PHP on August 24; patched releases and public disclosure followed on October 21.
The source does not establish the complete set of affected deployments, patched version numbers, or the scope of successful exploitation. It does state that PHP operators should update.