What the PHP2Shell rumors got wrong, from inside the PHP security team