This was big news because it was the news that a sector was looking for - that is, “AI Discovers a Cataclysmic and Widespread Vulnerability” - and confirmation bias does the rest.

It took me five minutes to realise that this was something of an nothingburger. As the author states, you basically have to have PHP running as root, and allow an attacker to upload and then execute malicious code on your server already - and if you’re there already the house is already on fire.