I'd say yes-ish, the 9.2 rating hints that it's not a straight to-shell exploit, but still serious enough that the step is probably easy enough, imagine the DB connection string or similar leaking through the working memory leak.

The reason it's so bad is because the multipart/form-parsing by the accounts I've read happens- or begins before the PHP code is actually run, ie it's in the initial runtime stage of a request.

If core developers say "this is actually bad", don't bargain if a patch is needed. Patch it.

There is no higher authority on "this is actually fucked" other than the people that actually make that very sausage.

Patching it is painful. It needs to be done regardless.

Yes, we should all patch like every other bug - but its the CVSS score and the panic which is in question.

I think I’ve identified every device on my internal networking running php, but I’d love a reliable poc I could poc that I could run before someone starts lateral movements.

If it’s easy to exploit then it should be easy to find a POC

CVSS scores are a bad measure anyway