While I'm not going to claim the PHP thing wasn't a real vulnerability, it... doesn't seem to have actually been catastrophically exploited? Maybe it's just too soon and over the next year we'll see a steady stream of people announcing leaks caused by failing to update php in time? Maybe there's a bunch of servers out there running old version of wordpress and quietly mining bitcoin because of it?
It wasn't exploited because half the internet shut down until it was fixed. Someone put up a site called "steal my bitcoin" with a vulnerable version of PHP and their bitcoin private key on the same server. It was hacked within two hours (of actually enabling PHP on the server) by someone with an AI agent.
loading story #50451127