Both the webserver (Apache) and PHP are off by default and have to be enabled separately, the latter by editing a config file. Essentially, only Mac-owning web

Both the webserver (Apache) and PHP are off by default and have to be enabled separately, the latter by editing a config file. Essentially, only Mac-owning web developers who enable these things (and serve PHP from their box to the world) are affected by any security problems in PHP. I imagine that most such web developers actually only dev locally and push the code to another server. It's nice that they updated them anyway.