The author didn't even have an accessible PHP server at first. When they actually added one, it got cracked in 2 hours.

milkshakes 9 hours ago | parent | next [-]

also it was under hn load which makes this much harder

HN load isn't exactly a high load for a server. The automated traffic was most likely much higher, but not high, as the server used the super slow single threaded php dev http server, so high traffic was not possible, everyone had to wait their turn.

	▲	elysianfields 8 hours ago \| parent [-]
		The vulnerabilities kinda rely on having to make quite a number of requests to exploit + can crash the process as I understood, so if many people try to force their way in at once 2h doesnt seems like a long timespan.

▲

jgalt212 8 hours ago | parent | prev [-]

yes, but 70% of the world's websites were (and many still are) accessible PHP server(s) that hand not been patched.