It took about 2 hours to get taken over and that was with a setup that's sufficiently non-standard that existing PoC would've needed tweaking.

The fact that people are still in denial over this is crazy.

I was sick when the news about php2shell broke, so ended up leaving two of my personal sites that use php un-patched for about 48 hours until my fever broke and I patched them. I didn’t get hacked. Was I just lucky and so shouldn’t infer anything about how hard it is to actually make use of this vulnerability? Probably.

I would take the opposite conclusion: the initial exploiting took _only_ 19 hours due the non-standard setup, but now the setup can be trivially exploited by tuning the PoC. By now, bad actors will probably have tools that can exploit most common setups.