While the PHP vulnerability is big news and needs to be patched, it's not that easy to exploit.
All of the POCs I found have hard coded memory addresses for the heap overflow and won't work for many versions out-of-the-box.
All of the POCs I found have hard coded memory addresses for the heap overflow and won't work for many versions out-of-the-box.
With the advent of agents, easy or hard doesn't matter much. One in thousands of agents will likely find a way, and that's what matters.
The related public challenge (https://github.com/KillaBoi/StealMyBitcoin-PoC) has been hacked after around 19 hours. It's up to debate whether it's really representative (at first it wasn't for sure, but it's been corrected), but shows that there has been an exploitable RCE pathway.