Where do you get the two hours from? Did this attacker spend two hours on it, after 17 hours of others failing to break in?

> The fact that people are still in denial over this is crazy.

Maybe you misunderstand what I say.

Imagine the tens of millions of personal or small business websites running php. What's your guess, what portion of the unpatched ones is already pwned? Is it 1%? 5%? 15%? 50%? 95%?

What would you guess?