Completely agree here - You should patch PHP but the sky is not falling yet. The issue here is going to be all the IOT Crap that just does not ever get updated. There still is time to patch. If you want to see the state of things, find a cyber range (I prefer HackTheBox). Go look for a bunch of old PHP Boxes and try the exploit out on them. Right now I think you are going to have a tough time finding a retired box that you can exploit with PHP2SHELL.... Atleast I hope you do because I am having a hell of a time doing it and both love/hate to learn how much of a noob I am at times. AI is really good at making crap look good. I know the POC that shows a POC of <?php echo("OK") ?> being exploited sounds scary. But when you look deeper there are a lot of hard-coded offsets that make it only work on that target.