The set of vulnerabilities is dubbed PHP2Shell and disclosure is scheduled for 14:00 UTC with attacks expected to follow soon after.
It is adviced to take offline every non-vital services until the patch has been installed (or the Docker image has been updated with a patched version of PHP)
Update: fix is out https://www.php.net/archive/2026.php#2026-10-21-5
Shouldn’t especially vital services be taken down to secure them?
takes down 112 / 911 services
Don’t worry guys, we’re safe now! ꒰ঌ(˶ˆᗜˆ˵)໒꒱
Safe here, we use 999
round these parts we use 0118 999 881 999 119 725 3
We’re YOUR emergency services
As if those are running anything as recent as php.
For their interactive mapview in the control room they probably do.
Yep. Except if taking them down will kill people.