From what I can see, this causes a crash only, and isn't weaponisable. It's a use-after-free, but the reclaim window is zero by construction.
It's going to be pretty bad if we all panic to get the latest PHP up, and all confidently roll out our updated websites, just for them to still be vulnerable to something serious anyhow.
Meaning this specific bug the parent comment is talking about is not new in just these patched versions from today.
So delaying your updates today would mean you’re exposed to an actively exploited RCE and still exposed to the other memory corruption bug (which may or may not be an easily exploitable RCE) for an entire 2 or 3 days.
And from the sounds of it people are very actively exploiting this so waiting 24+ hours will practically ensure you’re hit.
We are damned if we don’t and (often times) damned if we do
This needs to be said, and this language cannot be saved.
Just point Claude at your PHP and ask it to rewrite it in Rust. I know it seemed crazy when Bun did it (and it probably was), but it actually works now. (And please try it before you say "that's what people said 6 months ago" or whatever.)