> Just a normal "have to patch it and bye" medium kind issue.

Patching it was the issue, not the hole.

1. The patches had to be unofficially backported to the versions of php that most people were using.

2. Devs had to figure out if the unofficial backports were safe and they weren't just falling into trapped versions

3. Devs had to migrate all of their projects to unofficial versions

4. No one was ready for it to happen because there was no advance notice (someone broke the embargo) for everyone to plan maintenance windows and upgrade at the same time.

People say this vulnerability was "not super large easy to exploit" because of one poorly-informed skeptical blog post that hit the top of HN, but the evidence strongly suggests that post was simply wrong, and we're just going to have to live with the misinformation until it decays.

At this point the play is simply to move the goalposts, suggesting that vulnerabilities don't matter so long as you yourself couldn't easily exploit them, regardless of what well-armed attackers can do with them. That's, obviously, not how software security works.

But imagine the potential fallout if so many services didn’t get so scared that they preemptively took themselves offline.

Apply sarcasm or not based on sleep deprivation.