The set of vulnerabilities is dubbed PHP2Shell and disclosure is scheduled for 14:00 UTC with attacks expected to follow soon after.
It is adviced to take offline every non-vital services until the patch has been installed (or the Docker image has been updated with a patched version of PHP)
Update: fix is out https://www.php.net/archive/2026.php#2026-10-21-5
It’s just one thing after another. I already had to make sure every computer and VPS has the updated CA certificates earlier today. Now I just finished disabling all of my web servers. I hope Debian doesn’t take forever getting the patch out.
They took just a few hours to squeeze out a new ca-certificates. On the other hand the last time there was a huge kernel bug it took well over 24 hours I think…
They took a lot longer than that on some past vulnerabilities, some of them sat unpatched for weeks or months. But it depends on the severity. A remote exploit of severity 9 will probably get expedited.
A bad ca is update a file on every pc and application. A kernal bug is way more involved so it doesn’t make a new problem later.