Comment 5 for bug 919451

PHP is apparantly testing a patch to mitigate this vulnerability, for which they requested to push back the disclosure date by two weeks.

Unfortunately, due to an error on PHP's side, their bug tracker entry was initially marked public; as such the vulnerability has been prematurely disclosed, with no upstream fix available (yet).