PHP has released patched versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fixing two flaws that allow remote code execution without login. Apache with mod_php is rated highest risk. If your website, shop or back-office runs on PHP, ask your web developer or hosting provider to confirm you are on a patched version. If you cannot upgrade yet, the vendor suggests setting memory_limit=-1, lowering post_max_size to 8-32MB, setting session.upload_progress.enabled=0 and fatal_error_backtraces=0, then restarting all PHP workers. Linux distributions have pre-released patches and Docker images are expected within minutes.