PHP's fix for two critical bugs lands Oct 21 at 14:00 UTC (details). Details have already leaked, so the gap between patch and exploit may be short. Tonight:

1. Find it everywhere. On hosts: php -v and php -i | grep -i 'Server API', plus ls /etc/php* /opt/*/php* 2>/dev/null; for packages, dpkg -l 'php*' or rpm -qa 'php*'. In containers, search Dockerfiles for FROM php: and scan running images with your SBOM tool (for example syft <image> | grep -i php).
2. Don't forget the hidden ones: WordPress, Drupal, Magento and Laravel hosts, vendor appliances with a PHP web UI, CI runners, and shared-hosting or managed-platform accounts where the provider patches for you (check their status page).
3. Pre-stage the update. Know which repo you pull from (distro, Ondřej Surý PPA, Remi, official Docker images) and whether it usually ships same day. Distro backports can lag the upstream release.
4. Shrink exposure until then: put internet-facing PHP apps behind your WAF, take test, staging and abandoned PHP sites offline, and isolate PHP 5/7 hosts that won't get fixes.
5. After patching, restart PHP-FPM or Apache so the new binary is actually loaded, and confirm with php -v and a phpinfo check on the live pool.