I think the lesson with the PHP stuff is that orgs who calmly figured out which assets and updated PHP and/or applied mitigations won.

It is a real vuln, and critical, and everybody did the right things defending.

Security vendors themselves need to do much better as they were hugely slow to supply patches, and often lacked ASLR and other basic mitigations.

It’s not the only critical vuln, even in PHP. Calm heads will prevail.

And stop buying the AI apocalypse hype.