Your later insights about the vuln POCs being a scam helped me better understand the situation.

I could see the value of the embargo in the old world of “6 uber security firms and a few bounty hunters” but the new world of pointing AI at the PHP source just seems flimsy.