CISA says no PHP exploits observed yet, but unpatched flaws pose risk

The distinction CISA is drawing matters: absence of observed exploitation is not the same as absence of exposure, and the agency's emphasis on patching rather than on incident response suggests the concern is about latent, unmanaged risk across organizations that treat PHP as background infrastructure. The practical burden falls on operators running PHP-dependent services who may not track upstream advisories closely. Whether the quiet exploitation picture holds, and how quickly unpatched instances get addressed, is the open question worth watching.