Server operators running affected configurations must disable one setting now, while attackers have so far mostly probed the PHP2Shell flaws without confirmed compromises.
Defenders should not treat the public disclosure date as the earliest point at which the flaws were exploited.
Affected servers need patches for a PHP bug, and some certificates from one authority may still be trusted by a macOS utility.
Operators running PHP on public sites face urgent patching, and no temporary workaround fully blocks the attacks.
Self-hosted customers must patch or restrict access now; cloud users are not affected.
Organizations running affected appliances can now patch them and check for signs of compromise.