Yep. I pointed an agent at the Twitter post about the "working exploit that gets a shell on an unmodified MediaWiki installation.". 5 minutes later it spins up a stock MediaWiki and proves its POC. It modified someone else's POC from Github, but that's still trivial.

Everyone knows that MediaWiki is exploitable. The story running around is exactly that this is generally exploitable even for simple apps serving static content like this.