PHP hasn't said yet, and watchTowr's FAQ lists both the affected versions and the fixes as "to be confirmed". CERT-EU's advisory says the flaws could affect all PHP versions from PHP 5 onward, citing a public post, and that no technical details are public. CERT-EU tells organizations to prepare for immediate patching. Where that isn't feasible, it suggests isolating internet-facing applications from public networks until a fix is available.

PHP currently supports the 8.2, 8.3, 8.4 and 8.5 branches, according to its supported versions page, and security support for 8.2 ends on 31 December 2026. PHP 8.1 and older are end of life. I don't expect an official fix for them, and Sansec says servers on 8.1 or older get none.