Wiz (subsidiary of google) claims to have a working exploit: https://www.wiz.io/blog/php2shell-php-rce. Calif has as well: https://calif.io/php2shell/. Calif even posted a video demonstrating the exploit (subsequently removed)
I also think people want to check it with a vanilla install, not with "poorly configured servers" etc.
I've seen a bit too much (early on, ive not checked anything in the last 12 hours) saying "exploit confirmed", no one is disputing that, just its efficacy - specially after the hype and vanity sites.
History proves that new technology makes people twitchy in every direction. My anecdotal memory of X-rays is entertaining (we can use them to beam knowledge into brains!) and apocalyptic (X-ray guns will make warfare terrible!).
I have a rule for everything: the information is valid in inverse proportion to its political value. This is a bad exploit, and it happens from time to time. There's also an IPO connected to AI that is very political for many people who threw a lot of money at it.