All the "working" php2shell exploits on GitHub and X are like that. There are ZERO publicly available RCE exploits for php2shell that actually work remotely on production deployments. All of these RCE PoCs are local and rely on unrealistic setups because LLMs couldn't achieve RCE without resorting to reward hacking.