It wasn’t that difficult of an exploit, to be honest. I myself am not the leetest of the leet but I was most of the way there, having been set back by the downtime and my time zone. It’s definitely a fiddly, tricky exploit as most memory exploits are but I think the initial alarm was justified.
While waiting for the server to come back up, it took me about 3 hours with LLM assistance to write a php2shell RCE for nginx and mediawiki on the same version of php as TFA.
The biggest win, as others have also observe, was the demonstration that there aren’t swarms of automated pwnbots out there that will insta-root your server.
Considering the amount of downtime, I think that flag got got pretty quickly.
There are, they just didn't have a working exploit. Anyone with a honeypot can tell you attempts were widespread going back to early last week, but it wasn't until Saturday that we started to see successes.
Ok but a mediawiki page is obviously not comparable
People were complaining that originally it was just using php to serve a static index.html file
It looks like after 18-19hours they updated it to serve a real .php file and it was hacked less than 2 hours after that