A really good mitigation for this btw - AppArmor or SELinux.

Google something like apparmor restrict php from executing commands. Works against these CVEs.

Sucks for cybersecurity vendors who shipped their appliances using PHP without SELinux or AppArmor, of course.