But you wrote: "There are now multiple posts from vuln research teams all of whom have working RCE POCs against unmodified PHP applications." ? Are those "multiple posts" top secret?
However, that still doesn't actually show that the original post is wrong - since we can't actually see how it can be exploited against a vanilla PHP server.