Probably because it takes time for them to run all the regression tests. They don't want to break something while fixing something else. Damned either way.

In the meantime, you can mitigate the vulnerability significantly by following the instructions here: https://www.abstract.security/blog/php2shell-critical-php-rc...