The patch took an afternoon. The inventory will take the week
Mitigation code available
Two unauthenticated remote code execution bugs in PHP core, CVSS 9.2, with upstream releases out the same afternoon. The patch is the easy part. CISA's first instruction is to inventory every system running any PHP, and on most estates nobody can do that tonight.
