Ok, based on my reads on Wiz and Calif writeups, there are 5-6 issues mapped to 2 CVEs.

Wiz (with GPT 5.6 Sol + Gemini 4 Argon) : Remote process-memory disclosure; OPcache type confusion; Fatal-error backtrace UAF. POC on Wordpress, Drupal and Joomla

Calif (with LLM, no specific model, but model is accessible to all): Zend HashTable OOM. Targets PHP-FPM and mod_php.

Both discovers the UAF on upload progress unserializer.

Surprised to see the anime girl dancing with POC is really uploaded by Calif researchers.