Be careful over the next few days.
This affects most of the internet, and websites may have been quietly breached recently without their owners knowing. We will see the aftereffects of this for a long time.
If you run your own websites and servers, update your PHP as soon as possible today. (actually, you should be updating your servers every few hours, daily - vulnerabilities and patches are coming out every other hour these days…).
If you run a WordPress blog of any size, consider turning it off until the server is patched and fully block access to PHP scripts, as all are vulnerable.
The PHP security team is giving advance notice: Upcoming security release Wed, Oct 21st 2026, 14:00UTC, two critical vulnerabilities, both rated CVSSv4 9.2.
PHP users are encouraged to prepare to update. Earlier release if details become public or active exploit evidence.