watchTowr confirmed no exploitation in the wild yet and no workaround exists — patching is your only option. Apply the PHP security release immediately; Thursday's timeline is no longer the plan.
Reward: You've received a Rushed Release Medal — it pairs beautifully with your Unplanned Overtime Trophy.
BleepingComputerPHP warns admins of two critical flaws, emergency patches coming tomorrowThe PHP security team is warning administrators to prepare for emergency security updates tomorrow to address two critical vulnerabilities, as information about the flaws has reportedly leaked ahead of their scheduled disclosure.