The real race against the clock only begins after the update that closes the leaks has been served.

The real race against time begins after PHP releases an update to fix vulnerabilities. Hackers can exploit these weaknesses until the update is applied. Although vulnerabilities were known since Tuesday evening, verified attack methods have not yet been publicly shared. Organizations are advised to take their systems offline to prevent potential attacks. The National Cyber Security Centre has not detected active exploitation but urges preparations for the upcoming update. The PHP Foundation has also reported no signs of misuse, while Cloudflare noted attempts at attacks without confirming their success.