Comment by athrowaway3z

An unexploited PHP server means "there exists a configuration that is not exploitable".

Which is how hundreds of previous exploits have had people publish information on what to temporarily tweak/disable/block, such that the exploit wouldn't work.

What is novel about this case, and for which i do not know the explanation, is that nobody in-the-know was willing to confirm them before the CVE dropped.