There isn't an easy exploit for this PHP vulnerability: https://eliastaylor.com/noexploit/

It's so hard to take the panic seriously when the only way admins have for testing & evaluating how vulnerable their installations are is looking at the version number on the box.

There's a world of difference between needing to plan a smooth update or migration soon & needing to break everything now in a panicked, frenzied patching fit that's indistinguishable from a successful exploit to an end user.