>"cybersecurity experts" had a big role in this
Nobody listens to experts. Maybe you mean cybersecurity influencers? Actual experts, like in most industries, are not the most visible.
You are basically correct in your estimate of the severity. Exploitation, at least now, requires knowing exact PHP config and a lot of tweaking.
There was a complete panic on the internet and in all HN threads, with people claiming insane things like "this is already exploited everywhere in the wild" (it was not), "it took me 10 minutes to replicate this vulnerability from a public information" (yeah, sure) or "there is a public blog post with a writeup" (it was hallucinated AI slop). Voices of people who knew more, while present, were drowned in fake news. It didn't help, that in the first threads people who knew more (and were serious about coordinated disclosure) couldn't say much, so people sharing the most, knew the least.
I wish I could help, but honestly there were so many people parroting incorrect information that it's impossible. Signed, someone who got information about this vulnerability before it was publicly known, and worked to remediate it.
Nobody listens to experts. Maybe you mean cybersecurity influencers? Actual experts, like in most industries, are not the most visible.
You are basically correct in your estimate of the severity. Exploitation, at least now, requires knowing exact PHP config and a lot of tweaking.
There was a complete panic on the internet and in all HN threads, with people claiming insane things like "this is already exploited everywhere in the wild" (it was not), "it took me 10 minutes to replicate this vulnerability from a public information" (yeah, sure) or "there is a public blog post with a writeup" (it was hallucinated AI slop). Voices of people who knew more, while present, were drowned in fake news. It didn't help, that in the first threads people who knew more (and were serious about coordinated disclosure) couldn't say much, so people sharing the most, knew the least.
I wish I could help, but honestly there were so many people parroting incorrect information that it's impossible. Signed, someone who got information about this vulnerability before it was publicly known, and worked to remediate it.