State hackers and others prepare how to use exploits long before they happen. If there was an opened known RCE in PHP they would have caused havoc immediately. Clearly that did not happen.

Is this HN or boomer FB? I don't know anymore.