RCE Vulnerability in PHP 8.5.11 / Downtime for museum-digital

As has made the news, two critical remote code execution vulnerabilities for all PHP versions available until yesterday were released. See more in the news (Official Statement, Bleeping Computer).

Almost all of museum-digital runs on the most current stable release of PHP, which is PHP 8.5. Following the packet sources we track (and which are recommended by the official PHP project), the most recent available version is PHP version 8.5.11, which is still vulnerable. A patch fixing the security holes has been released by the PHP team, but is not yet available in the packages.

As such, we will take museum-digital offline until the new, patched version becomes available in the regular way. We hope that the issue will be fixed within hours (considering a patch is out in principle), but obviously can only hope ourselves.