“You can only do one attempt at a time, so that means multiple days of bruteforcing in a way that is essentially a DoS”
php2shell needs four requests to land on the same PHP worker. A stock server runs 150 of them. Pulling it off means days of noisy brute force that any operator would notice. HoneyLabs hasn’t seen one attempt that could actually work. The AI security vendors screaming about it had something to sell.