The PHP Foundation “will release a full advisory and fixed software with the next regular PHP release.”
The PHP Foundation says this one needs “a very unlikely combination of configuration and specific PHP application code.” Those are famous last words in PHP. The bug is now public and the fix isn’t. Every attacker on earth just got a head start on finding that unlikely combination.