>This really sounds to me like "they filled out some webform" or "sent an email to security@php that read like any of the ten billion we found vulnerability in your code please send money emails

i highly doubt it. these are pretty big names in the security sector who have plenty of experience reporting high severity vulns.

and they also have plenty of exposure to their motherships burning money on LLMs