This has been my hyperfixation for the last few days, and I've been trying to keep together a detailed and timestamped timeline of the evolving situation:

https://claude.ai/artifact/5cZex56WutyVnpMBrWXxzV

TLDR is multiple entries that show successful exploitation against particular setups (quite often honeypots that were kinda set up to be exploitable e.g. single worker mod_php or lab setups that are unclear on how well they match real deployments), one claim from dan guido / trail of bits about a broad exploit (but few details), millions of attempts in the wild but very little evidence of actual compromise (unit 42 withdrew theirs).