All my web sites, and all the sites I host, are shut down until the PHP patch is out and I can apply it.

Folks I trust assure me it's really that bad.

https://arstechnica.com/security/2026/10/php-maintainers-tell-web-devs-to-prepare-themselves-for-critical-security-patches/