I was sick when the news about php2shell broke, so ended up leaving two of my personal sites that use php un-patched for about 48 hours until my fever broke and I patched them. I didn’t get hacked. Was I just lucky and so shouldn’t infer anything about how hard it is to actually make use of this vulnerability? Probably.