The demo video has been going around Twitter today and apparently the proof of concept is privately being shared around too. The video shows pasting something in the URL and then gaining a shell on the server. It looks completely catastrophic.

I think the best course of action is to just shut your server down before the patch goes live and then bring it back after you have patched.

Some more discussion: https://news.ycombinator.com/item?id=50171528

No hints as to what versions are affected?

A lot of people are going to be up late on account of this.

There is allegedly a temporary mitigation: https://twitter.com/k_firsov/status/2112718728232329240

php.ini:

    session.upload_progress.enabled = Off

If the rumors for these exploits being shared on Twitter are correct this is going to be a nightmare. I wouldn't be surprised if VPS hosts step in to mitigate it somehow since so many cheap/unmaintained LAMP installs are running on those servers.

Strange to see this so far down the front page. If the rumors are true, it may be worse than Log4Shell.

Uh oh, POC is already out there https://jackalsyn.com/posts/php-up-2026.html