Tough day for everyone running PHP-powered services.
PoCs are already available on GitHub. If possible, I’d strongly recommend disabling PHP-powered services exposed to the internet until a fix is released. Once the patch is available, apply it ASAP.
Patch expected at 14:00 UTC (16:00 CEST).
We already see exploitations on some production services.
Stay safe.