I am confused. Is this attack possible even after the PHP patches OR these servers just didn't patch ?

> The affected devices run specific versions of a large vendor’s firewall software.

And the vendor's firewall software runs an unpatched version.