My hosting provider just informed me that they took down my website over this to "protect" me. It's a static website that does not use any php. But it's a generic LAMP hosting provider so they just took down all their hosted websites. I had it on my to do list to migrate that to cloudflare anyway. So, I guess I'll be doing that soonish now.

If open source has these vulnerabilities, imagine proprietary ones.

The best time to code away from PHP was 20 years ago. The next best time is now.

apt-get update + apt-get upgrade fixes it on Debian, but not on Ubuntu for now

debian trixie just rolled updates.

Trying to install this update but it appears that Launchpad doesn’t have the bandwidth for half the world to all update at the same time.

While the patches are being merged for the official docker images, perfect time for a github outage! https://downdetector.com/status/github/

Gentoo has it updated.

I've created patched Dockerfiles for EOL PHP versions. The patch is obtained from official source trees.

I've also published the built images from them to GitHub Registry, but of course it's best to inspect any public repo/docker image before using them blindly.

https://github.com/a-nych/php-eol-backports

They have to backport this fix or else leave a large part of the internet broken.