Using a tool like Shodan, I can quickly get a list of addresses that have a specific version of PHP behind it.

It sounds like this is a cvss 9.0 or higher for PHP which is bonkers because PHP is such a huge amount of the internet.

My guess is releasing these CVEs the normal way could have catastrophic consequences. They're giving stsadmins a heads up so there is less of a scramble when sysadmins read "hey fix your shit it's totally vulnerable" before they have their coffee.

Like as a sysadmin, this is a great way for them to do this.

I will in 10 mins alert my team that the whole site has to come offline for a period today. I don't need to take it offline in an emergency and tell my boss to send out a memo.