“Nearly 70 percent of websites need to update their core software to fix a pair of vulnerabilities that allow an attacker to seize full control over affected servers.”
The bugs reach back to PHP 5.4. That version shipped in 2012. Exploitation was live before most admins finished reading the advisory. The outages are the cost of a web built on a language nobody budgets to maintain.