Wow, this article really reads as LLM-generated to me. The quoted section with the “We won’t pretend otherwise:”, the second paragraph in:

This post isn’t about how to update. It’s about how these vulnerabilities were found and fixed, what has changed in how PHP security is handled over the past two years, and what we need from the organizations that depend on PHP to keep PHP’s security work going.

Could they not be bothered to write a write-up about such a critical severity?