An embargoed security issue in PHP leaked and it is extremely serious: all versions >5.4 are affected. No patches are available yet.

I highly recommend shutting down any PHP services until the patch is available—that's how serious this issue is.

Apache HTTPD users can run

a2dismod php8.2 # any version
a2dissite <affected website configs>
systemctl restart apache2

https://cert.europa.eu/publications/security-advisories/2026-018/