I was halfway through a coffee yesterday evening when the PHP security advisory landed in my feed, and the coffee did not survive the next ten minutes. Two critical remote code execution bugs, unauthenticated, and the PHP team's own wording was "update immediately". No "consider upgrading when convenient". That phrasing is rare enough that I stopped what I was doing.

Short version for the impatient: update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, restart your workers, and confirm with php -v . Everything below is the checklist I'm using, the stopgap settings if you can't patch yet, and a few places where I think people will get tripped up.

I'm not a security researcher. I'm a developer who deploys PHP apps for clients and runs a few boxes of my own, so this is written from the "I have to patch this today and prove it" side of the fence. Read the primary sources too. I link them as I go.

What the advisory actually says

The official advisory on php.net names two bugs.…