PHP shipped its fix, attackers launched millions of attempts, and governments say no one has broken in yet.