Two critical PHP core bugs leaked a day before the embargo. The fix ships on October 21, and most PHP servers on the internet will not get it.