RIP anyone running a PHP website (and yes, that means Wordpress). Patch or get popped very badly indeed.
Looks like only PHP 8 is getting a patch, so if you're below that, you're inherently vulnerable.
This is a no good very bad bug.
https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
