While I'm not going to claim the PHP thing wasn't a real vulnerability, it... doesn't seem to have actually been catastrophically exploited? Maybe it's just too soon and over the next year we'll see a steady stream of people announcing leaks caused by failing to update php in time? Maybe there's a bunch of servers out there running old version of wordpress and quietly mining bitcoin because of it?

But PHP thing was a lot of drama over something that was not super large easy to exploit hole. Just a normal "have to patch it and bye" medium kind issue.