The backporting point is the one most people trip on: "the version alone doesn't tell you" cuts both ways - scanners flag patched hosts as vulnerable, and renumbered builds pass as fixed. What struck me reading this next to this week's EDK II case (CVE-2026-97631) is that PHP2Shell is now the second coordinated disclosure in days to break at the vendor-communication stage: details leaked a day early here, and in the firmware case the fix sat in a public pull request for months before the planned January date. Two different ecosystems, same failure mode: the process assumes every participant can hold a secret, and the biggest ones can't. Did you see any sign that the leak changed exploitation timing, or were the AWS and Cloudflare attempts already running before it?