CCN-CERT rates the two flaws as critical because they allow an attacker to run code on the server. INCIBE-CERT has updated its alert for PHP branches 8.2 to 8.5.
In the Canaries, several public, educational and university platforms have limited exposed services. The University of La Laguna, for example, has restricted external connections and requires users to log in through its VPN. They stress this is a precaution and that there has been no intrusion or data leak.
If you have a WordPress site, an online shop or any PHP application, ask your hosting provider whether they have already updated. If it can't be patched yet, the advice is to temporarily isolate anything that isn't essential.
Sources
This is our own summary. The full story is in the linked outlets, which publish in Spanish.
