The set of vulnerabilities is dubbed PHP2Shell and disclosure is scheduled for 14:00 UTC with attacks expected to follow soon after.
It is adviced to take offline every non-vital services until the patch has been installed (or the Docker image has been updated with a patched version of PHP)
Update: fix is out https://www.php.net/archive/2026.php#2026-10-21-5
depends. do you want to deal with a simple patch in 24 hours or do you want to rebuild an entire legacy system from nothing (assuming you don’t take proper backups)?
How dare you (correctly) assume I haven’t taken proper backups!
Jk lol
I do have a couple backups I made a few months ago. Never tested restoring them, so I don’t count them as “real”.
I’m hosting on namecheap servers, using their cpanel and stuff. So I don’t have the option of installing my own PHP version, just selecting theirs.
But apparently they had some mitigations in place before updating, and then they got us updated.