FWIW this is the most mainstream vulnerability in the new era where everyone has access to AI agents that have the potential capability to find and widely exploit the vulnerability far faster than the past timeframes for disclosure and patching.
The average phpBB or Wordpress, even if it's behind cloudflare, probably has a direct IPv4 that's not disabled.
This is a storm, but hopefully quick to blow over with a panic frency of apt update or docker build.
The immediate exposure is faar worse here though, since its by design internet facing code.
A college enabled logging on their server as soon as they saw the news, and got dozens of attempted requests against index.php.