There only needs to be one working exploit, and yet even with thousands of people working either manually or with LLMs, no one managed to get one so far.
Again, obvs you should patch your servers, but the point that this is not an easy exploit stands.
How do you know there is none? Because both the PHP devs themselves and the companies involved in the patches said they had working PoCs.
Do note that commonly a blackhat, or state operative will not chuck their code on github, but either try to sell it, or try to use it to quietly get footholds on strategic places.
The crucial piece of my statement and my question is that such an exploit doesn't have to be on GitHub to exist.
Again: such exploits are typically not distributed, hosted or published on platforms like GitHub. But on forums, boards and shops on the dark or deep web.
Again, obvs you should patch your servers, but the point that this is not an easy exploit stands.