A developer reviewing public PHP2Shell exploit code argues that requirements involving the exact build and worker process complicate claims of immediate mass exploitation in complex production environments. That does not make vulnerable systems safe: lightly defended, low-traffic sites remain at risk, and the author acknowledges not being an exploit specialist. Related operator discussion offers personal observations about logs, not proof that compromise did not occur. The conclusion is to distinguish attempted attacks from confirmed exploitation while patching as soon as possible.