This appears to be an FPM exploit: https://github.com/KillaBoi/St...
But notice it has to make a huge amount of assumptions about the configuration of the server in order to work. So this kinda sorta underlines the thing you say, assuming the hacker cannot obtain the output of php_info() - it's not unheard of for PHP devs to include that somewhere so they can check what's going on. It makes script kiddie stuff a little less likely, though a hacker specifically targetting a specific installation will likely be able to break in.
I've read various comments about viable this exploit is, and even submitted a link to someone's commentary to Slashdot about how it maybe overblown (https://eliastaylor.com/noexploit/) - The infosec community seems genuinely split on it, and I'm not sure this proof of concept is really going to convince anyone right yet.
The reality is we should probably not have acted as if a nuke went off last week, while at the same time we should patch it on a "just in case" basis. The 4 thing was more serious, and remains more serious given the number of IoT devices that'll accept 4 forever. This, on the other hand, is a good reason to stay up to date.