Was PHP2Shell actually exploitable outside of a lab environment?
Yes

From over 10k unique IPs:

Only two IPs managed to trigger the print-flag executable and only one person did so in such a way that data was exfiltrated successfully from the server.

PHP2Shell is the real deal. It’s an exploitable vulnerability and a sufficiently motivated adversary, with the help of AI, can absolutely use it to hack a website even when they do not have direct access to memory addresses or the physical server to tailor their exploitation pathway.