The certificate incident requires a working MitM of TLS traffic. That isn't easy to pull off and browsers will immediately warn you the second they see someone try that.

The PHP exploit, as presented, runs directly from attacker to server. There's no requirement for an attacker to already be in the network.