Remember when Log4J happened and everyone said "well let's just move away from Java"? Yeah, me neither. And that was just as big a deal.
Sysadmins, upgrade your servers. This is an easy process. If it's not, then the problem isn't PHP, it's your process. The same would be true for a JVM bug, Windows bug, Go bug...
If your org couldn't upgrade quickly and easily, this is a wake up call to review your release process.