The PHP development team announced on October 20 that emergency updates for two remote code execution flaws, each initially rated 9.2, would ship October 21 at 1400 UTC, after the secret patch leaked on Hacker News two days early. The second flaw is now rated 10 out of 10, with fixes in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Amazon Threat Intelligence saw exploitation attempts against its honeypots as early as October 17, and Palo Alto Networks found 22 million places where the vulnerability persists. The patches cover only PHP 8.2 and newer, and downstream projects could not build new releases before the accelerated date, so some sites shut down instead of patching.