> Why are you speculating?
Because the PHP devs and the researchers all explicitly stated that they have PoCs that can exploit it. Are they lying? Exaggerating? Spreading FUD?
I am speculating as to why the ones who have the most information tell us something very different than a "random blogger who tried repos on github".