> Is it so bad? Have you measured the number of attacks?

It is not a torrent, no. Dozens up to hundreds, rather than hundreds to thousands.

But they would very likely have succeeded, right? It's a fairly turnkey vulnerability.

> I run a tiny server. I like this server a lot. I only patched an hour after the Debian package was ready and didn't think about it again. Do you mean to imply there's a real chance my little server has been compromised?

Can't say one way or another. Have a look at your log file for POST requests in quick succession for things like

  /_next 
  /_next/server
  /app
  /actions
  /api
  /dashboard

> [Edit:] My server is quite public too. It hosts four SLDs and many subdomains and receives both human and bot traffic. Only one or two subdomains use PHP, but a reasonable attacker surely tries all of them.

All my "obviously PHP app" domains got visited. None of my bespoke app domains (which are not obviously PHP). Though over time, the bespoke domains do get a whole bunch of boring probes for WP vulnerabilities etc., like all websites get.