PHP2Shell was exploited before the patch. Expect more of it.

One cyber firm listed a half-dozen exploitations of the PHP2Shell bugs, and another identified a well targeted, suspected Chinese campaign that breached U. S. "government affiliated" servers.