Please report security problems in php2shell itself (for example, a crafted response header or file that crashes the scanner or makes it run code) through GitHub private vulnerability reporting. Do not open a public issue.
You can expect an acknowledgement within a few days. Fixes are released as a new tagged version.
A wrong verdict (for example, a patched build reported as vulnerable, or the
reverse) is a bug, not a security vulnerability, unless it hides a vulnerable
system. Open a regular issue with the PHP version string, the package name and
version, and the --json output.
php2shell does not handle reports about PHP. Report PHP vulnerabilities to the PHP project: https://github.com/php/php-src/security