Patching is slow for sites on older PHP versions, and an early warning of a working exploit was withdrawn.
Affected sites had less time to patch than planned, adding pressure to how quickly maintainers can respond to AI-found bugs.
Organisations are still checking exposure, and experts warn the fallout may take months to fully emerge.
Defenders should not treat the public disclosure date as the earliest point at which the flaws were exploited.
Millions of exploit attempts have been logged, but it is unclear whether any attack has succeeded, and only the latest PHP release carries the fix.
Operators running PHP 8.1 or older have no official fix and must move to a supported branch.
Sites running PHP may need to take systems offline until fixes are applied, as attackers were already probing the weaknesses before the public warning.
Operators running PHP 8.1 or older face the most pressing risk, since no official fix is coming for those versions.
Operators running PHP on public sites face urgent patching, and no temporary workaround fully blocks the attacks.