Hackers were already probing the bug before defenders were told it existed.
Ars Technica
• Tom Wilson and Rafe Rosner-Uddin, Financial Times
Hackers got a four-day head start on epic PHP2Shell vulnerability