BSI advisory on PHP: https://www.bsi.bund.de/SharedDocs/Cybersicherheitswarnungen/DE/2026/2026-297981-1032.html And yes, I agree with everybody it is best to patch where updates are available. There *are* mitigations for some of the chain which may be useful as an interim measure - they should be in the PHP advisory I’m guessing, if not I’ll do a blog later. SELinux and AppArmor, configured correctly, work well and should be considered regardless.