A message as vague as "there is a major RCE somewhere in this entire programming language" is usually pretty safe. We'll see how the details actually got out in this situation and whether the announcement caused it, but it still took a while. If you put out a patched build people will find and decompile the changes nearly instantly.

They gave too many details just by saying that it affects PHP 5 and later and is an RCE CVSSv4 9.2

This lets an AI agent look at the changes made from PHP 4 to PHP 5 and it also lets the agent guess what type of vulnerability it must be.