PHP2Shell was never overblown
Many argue the pre-execution RCE in PHP's request parser was severe all along, and this real-world chain plus the stolen challenge bitcoin proves it; some praise those who publicly revised their views.
Severe but hyped and clumsy
Others say mainstream and AI-marketing coverage exaggerated it, exploitation depends on deployment (e.g. PHP-FPM vs built-in server), and only 25 of 15k scanned targets were hit.
Vendor stack and exposure to blame
Commenters identify the firewall as Palo Alto PAN-OS, question shipping a big PHP interpreter in a firewall and exposing its management page publicly, and note Linux's large kernel attack surface enabled root.