The bug is real, its exploitable but only if the server also has a very specific vulnerability in order for php to be exploited. Which kind of makes it a non exploit. And the author is backing that up by point out the php runs about 70% of the web and the exploit has been out for over 10 hours (when this was written), if this was a real “we are very fucked” bug, we would be hearing about all the fall out from this already and we have heard nothing.

The (quite funny actually) take away here is that the “smoking gun” demos that prove this exploit show that the server vulnerability was specifically mimicked before the exploit test was run.