no it doesn't . absence of evidence is not evidence of absence
Which is how hundreds of previous exploits have had people publish information on what to temporarily tweak/disable/block, such that the exploit wouldn't work.
What is novel about this case, and for which i do not know the explanation, is that nobody in-the-know was willing to confirm them before the CVE dropped.
No it doesn’t. An equally plausible explanation is that nobody has tried. (Replace “PHP server” with “someone’s vehicle.”)