Comment by skrrtww

Cloudflare's blog post announcing its updated WAF rules directly implies the existence of in-the-wild exploits: https://blog.cloudflare.com/php-vulnerabilities-waf-protecti...

"Cloudflare successfully deployed multiple mitigations for all its customers while the vulnerability was leaked before the official release date and we observed attack traffic targeting our customers."

If that's not an in-the-wild exploit, it literally couldn't have been further away than one or two more iterations.