[smsm42]

PHP one is at best a moderate-level bug in SOAP client which I don't see any realistic way to exploit (the whole convoluted setup in the POC assumes PHP execution access, which begs the question why bother if you already can execute arbitrary code?) - does not look like "genuine critical" at all.

[newguy33]

Critical is an overstatement but it userland PHP execution does not equate to native process control. There are many situations where an attacker may have constrained PHP execution, gadget execution, template or plugin execution, deserialization reachability, or a sandboxed context, but not arbitrary native code execution or arbitrary memory write. Definitely impactful

[smsm42]

Security-wise, there's no such thing as constrained PHP execution, at least with the standard PHP engine. The surface is too wide. You still have OS constraints of the user and capabilities and such, but beyond that if you can run PHP code, you can run anything.