okay so apparently you need to shut down anything #PHP *right now* until the patch is out, with claims of mass exploitation immediately after release being likely

the claims are apparently credible enough that the dutch government took down their entire SSO/authentication/eID system