> already being exploited in the wild [0]

The article cites this commercial blog patting themselves on the back how they detect the exploit, yet after reading it I don't see any actual exploiting? Is scanning/probing the same as active exploitation all of a sudden?

[0]: https://ellio.tech/en/blog/php2shell-what-we-observed-and-wh...