From what I gather, https://x.com/J4ck3LSyN/status/2112703096443097263 figured it out after the disclosure by wiz.io and openai (which I think was 24h before the patch landed). So they then used AI models to analyze the php code and independently found the vulnerabilities.

So, if that is correct then the problem was the 24h prior notice about the patches, which gave time for people to use AI to find the bugs.