Even after PHP2Shell, blast radius matters more than a CVSS score

The article discusses two remote code execution vulnerabilities in PHP that attackers targeted before a patch was released. Its central conclusion is that the actual impact of an incident depends heavily on the service accounts, API keys, cloud roles, and tokens available to a compromised workload and the resources they can access.