> Just a normal "have to patch it and bye" medium kind issue.

Patching it was the issue, not the hole.

1. The patches had to be unofficially backported to the versions of php that most people were using.

2. Devs had to figure out if the unofficial backports were safe and they weren't just falling into trapped versions

3. Devs had to migrate all of their projects to unofficial versions

4. No one was ready for it to happen because there was no advance notice (someone broke the embargo) for everyone to plan maintenance windows and upgrade at the same time.