The set of vulnerabilities is dubbed PHP2Shell and disclosure is scheduled for 14:00 UTC with attacks expected to follow soon after.
It is adviced to take offline every non-vital services until the patch has been installed (or the Docker image has been updated with a patched version of PHP)
Update: fix is out https://www.php.net/archive/2026.php#2026-10-21-5
takes down 112 / 911 services
Don’t worry guys, we’re safe now! ꒰ঌ(˶ˆᗜˆ˵)໒꒱
Me when I take down only one hundred twelve out of nine hundred eleven services, leaving seven hundred ninety-nine services still running
Safe here, we use 999
round these parts we use 0118 999 881 999 119 725 3
I’ll never remember that. I’ll just send an email…
We’re YOUR emergency services
As if those are running anything as recent as php.
For their interactive mapview in the control room they probably do.