Comment by cloudlandsdev

Yes! Was serving pure html through PHP before 13:00-ish UTC when I added that page. From the traffic, it seems plausible that some people have an theoretical exploit path through PHP's HTML server itself, without relying on PHP functions, but no one has pulled it off quite yet.