Yes, and even for Debian because of ASLR, but these vulnerabilities may allow memory to be leaked and from those memory leaks an attacker can reconstruct the necessary information. That’s obviously not something just anybody could have done, but publicly available AI tools have made this level of attack complexity much more accessible. In www.youtube.com/watch?v=7CiZmq2llDg&t=629s they first find the vulnerability but their AI cheated to make it exploitable. I don’t think having errors enabled is actually necessary for the exploit to work, because if that was the case the PHP security announcement would have said “turn off errors” instead of “turn off your server now.”