As has been pointed out elsewhere, the exploit is the ability to inject code into the PHP Git repository. Not this RCE.

The other exploit, the one that allowed the commit to be injected.