I’m curious about this too, although I would somewhat hesitate to rely on that, except as a contributing point of information.

PHP2SHELL, in particular, made me expand my weekly security review to include my external network resources.

The natural conclusion for this seems to be realtime monitoring CVE and pre-CVE vulnerability indications in exposed stacks.