> Just knowing a "10.0" RCE CVE is inbound w/o extra details doesn't get you very far

Well that's exactly what chainguard claims though. "Find bad bugs in PHP" is the prompt they claim they used to rediscover the issue