Hey, you're leaving out that nginx's default is to cap at 1m, btw.
Luck is not a security boundary, they should patch their servers, everyone should. It's not a good thing to have shitty memory management on your server.
However, is this really that exploitable in real world conditions? (no)
Most variants require a few requests to infer some settings, and then they can spam their arming-stage, and then their exploit stage. Granted, its not quite as easy as that, but hitting _a_ worker twice on a server once is not all that lucky.
Also, 03:00 at night is not a busy time.
Can you link any reports about any site being afflicted by this exploit? (Dutch government website, or other)
The parent comment is implying PHP servers arent at risk, because default nginx limits requests to 1mb. I'm saying that is a bad argument, and a lot of real websites that went offline voluntarily, like the dutch gov, would have endpoints that accept >1mb requests.
Putting https://stealmybitcoin.com/ behind a default nginx proxy and giving it no features is a toy PR stunt hoping to salvage PHP's reputation.