They gave too many details just by saying that it affects PHP 5 and later and is an RCE CVSSv4 9.2

This lets an AI agent look at the changes made from PHP 4 to PHP 5 and it also lets the agent guess what type of vulnerability it must be.

Php4 -> 5 was a massive change including zendengine2 and an overhaul of many modules. Fortunately that information really doesn't tell us much. (Also it was a year of work between the first beta and the release - many changes at that time)

I mean an agent can walk those changes, but it's close to just walking all the whole source / research from scratch at that point.

Yep. It's probably one of a handful of functions. It'll be based on request input, a script doesn't have to call the function, and it works with default configuration. I bet it takes a half hour for AI to figure it out.