There's a third PHP2Shell bug, but it won't get an emergency fix (theregister.com)