I (non-technical) recently stepped into a leadership role at my company who is on an old Drupal 7 site running php 7.4.9. My lead developer said the fix issued for php2shell is not compatible with our old version of php and Drupal 7. He recommended taking down our website until we can upgrade to a newer version of Drupal… which would take a long time, and essentially would kill our business…. We did edit our WAF rules to help prevent cyber attacks but would appreciate any perspectives here and if anyone is in a similar boat.