If you're on PHP 8.1 or older, there is no official fix coming . Those branches are end-of-life. Your options are: upgrade, or ask your hosting/distro vendor if they provide a backported patch (some LTS vendors do).

What to actually do today

1. Check what's really running your site, not just your CLI version

php -v

Enter fullscreen mode

Exit fullscreen mode

This shows your CLI version. It is not necessarily the version serving requests. Check the SAPI that's actually live:

php-fpm -v curl -sI https://yoursite.com/ | grep -iE "^(server|x-powered-by):"

Enter fullscreen mode

Exit fullscreen mode

CLI and web versions can differ, especially on servers hosting multiple projects.

2. Patch internet-facing systems first

If it's reachable from the open internet, it's the priority. Internal-only services can wait a few hours if you're triaging a lot of infrastructure.

3. Don't forget bundled PHP

Docker base images, CMS installer bundles, and vendor tarballs often ship their own PHP.…