At the end of the day the number of instances that are publicly available is just clickbait in an article. What really matters is whether or not this is being a

At the end of the day the number of instances that are publicly available is just clickbait in an article. What really matters is whether or not this is being actively exploited in the wild. I have my own issues with Clickbait and dramatization of vulnerabilities, but I don't think this is necessarily something that we should be concerned about (as-in I think that this vulnerability is pretty damn bad and should be patched, regardless of if there are 2k or 200k instances). Sure some metrics around "number of instances out in the wild" will determine if threat actors put resources into developing mass-scale exploitation, but if you are patching for a company it doesn't REALLY matter. If you are a target and are exploitable it doesn't matter how many honeypots are reporting as Confluence -- you will be breached if your Confluence server is vulnerable and exposed. The best argument against honeypots would be that if we had some active group that was working with all affected users to patch and verify patches, if that was the case then the honeypots are a detractor. News outlets should do their best to get the best information, but this is the least-worst thing around vulnerability reporting IMO.