It looks like the PHP Armageddon bug may have been a bit overstated in that exploits require severe-level pre-existing vulnerabilities
If I'm to be completely honest, though, "has pre-existing severe code-level vulnerability" describes a lot of the PHP sites I've seen in the wild.