Initial PHP2Shell exploitation was observed four days before patches landed, and many servers run outdated PHP versions.