http2shell and php2shell are both really difficult to exploit. Not that they aren't serious (and should be patched), but it's not the doomsday scenario that the news makes it out to be.
As TFA says, this can be exploited only by someone who already has access to the internal network of the company.
Moreover, in well configured networks there is typically a separate network for the management Ethernet interfaces of the servers, to which non-authorized computers do not have access, and Ethernet booting of the servers is done through that network.
So the bug can be exploited only by a company insider, who must be an admin for the case with a separated management network, or by an external attacker who already has control over an internal computer, which must be the computer of an admin in the case with separate management network.
I'm wondering if this is the same.