alt Hacker NewsSomeone with a single gigabit internet connection can scan the entire IPv4 address space in less than a day. When you have public RCE vulnerabilities like this, your options are "apply the patch", "take the system offline until you can apply the patch" or "get pwned".
The list of options is larger than that. There are mitigations that can be quickly applied. See, e.g., https://ma.ttias.be/php-cve-2026-109618-early-mitigation/ and https://aws.amazon.com/blogs/security/using-aws-waf-to-apply...
Meanwhile, WAFs are being continuously updated with detection signatures.