We observed this update ourselves and suspected it to be a mitigation when it was rolled, but I can't find any definitive record that these rules are about the PHP vulnerability. Do you have more info?