The disastrous PHP vulnerabilities were exploited days before the patch — Blankdot