Wiz reports an approximately 67% decline in observed internet-exposed vulnerable machines and a 47.9% decline in affected organizations after PHP2Shell disclosure. These figures combine possible patching, upgrades and access restrictions, so they are not patch-completion rates. Wiz did not observe a complete successful chain in its own telemetry but cites a separate researcher’s code-execution evidence in a particular Apache configuration. CISA has also added both vulnerabilities to its Known Exploited Vulnerabilities catalog. Difficulty reproducing attacks across deployments is not proof of safety; security updates and exposure reduction remain necessary.