The question remains: is vanilla PHP with its default configuration easily exploitable? What are the prerequisites, and what configuration deviations are required compared to default config in the anime girl video?
The reason it's so bad is because the multipart/form-parsing by the accounts I've read happens- or begins before the PHP code is actually run, ie it's in the initial runtime stage of a request.
There is no higher authority on "this is actually fucked" other than the people that actually make that very sausage.
Patching it is painful. It needs to be done regardless.
If it’s easy to exploit then it should be easy to find a POC