Comment by Celeo

Very well said. Even for non-sensitive stuff that I was told was "super vulnerable", I didn't know if this was a full, actual RCE - some places said yes, others no. Did I need to take down everything running PHP? Just the apps dealing with data I didn't want leaked? Etc.

The rather long delay in getting official Docker images didn't help; we were told "patch now!!1!!" but that apparently meant building from source.