Did some more digging into the publicly available RCE exploits for #php2shell and the results look pretty sobering:

The arguably most promising one is 9bie's (https://github.com/9bie/php2shell-bypass-aslr-exp), which I spent some time looking at.
TL;DR: It works, but only under very controlled circumstances. More on it in a moment.

We also have https://www.exploit-db.com/exploits/52704, which is a (correctly attributed) copy of an earlier version of 9bie's exploit.

(1/n)