But imagine the potential fallout if so many services didn’t get so scared that they preemptively took themselves offline.

Apply sarcasm or not based on sleep deprivation.

People say this vulnerability was "not super large easy to exploit" because of one poorly-informed skeptical blog post that hit the top of HN, but the evidence strongly suggests that post was simply wrong, and we're just going to have to live with the misinformation until it decays.

At this point the play is simply to move the goalposts, suggesting that vulnerabilities don't matter so long as you yourself couldn't easily exploit them, regardless of what well-armed attackers can do with them. That's, obviously, not how software security works.

Are there better sources for understanding the scope of impact enabled by PHP2Shell? My impression from a variety of sources is that very few incidents can be clearly attributed to that vulnerability. As opposed the many other ol’ ways PHP applications get exploited.

> the evidence strongly suggests that post was simply wrong

What sort of evidence? What "strongly suggests" this was actually easy to exploit?

I'm not interested in arguing with you about whether e.g. Dan Guido is a credible source of exploitation information.

What a smug reply. Maybe you could just link to what Dan Guido has to say about it that supports your statement and why people should find that credible.

The fact that "steal my bitcoin" got its bitcoin stolen within 2 hours?

It's quite difficult to exploit. But so are most vulnerabilities, but attackers have figured out frameworks for exploiting hard vulnerabilities of this type. The proof is in the pudding - "steal my bitcoin" had its bitcoin stolen.

I think the post scan curl post did a lot of damage to the perception of real dangers.

Instead of highlighting the exceptional quality of curl, under intense, unprecedented scrutiny, the maintainer chose to dismiss Mythos as a nothingburger. I think this was a huge mistake and a disservice to curl itself.

The goalpost here was an apocalypse, thousands instantly hacked sites and hundreds of exploits flying around within hours. I did not made that goalpost. And reality did not hit that goalpost.

> vulnerabilities don't matter so long as you yourself couldn't easily exploit them, regardless of what well-armed attackers can do with them.

This is moving goalpost. The goalpost was not "yet another vulnerability like the others".

> Just a normal "have to patch it and bye" medium kind issue.

Patching it was the issue, not the hole.

1. The patches had to be unofficially backported to the versions of php that most people were using.

2. Devs had to figure out if the unofficial backports were safe and they weren't just falling into trapped versions

3. Devs had to migrate all of their projects to unofficial versions

4. No one was ready for it to happen because there was no advance notice (someone broke the embargo) for everyone to plan maintenance windows and upgrade at the same time.