Since I heard about this #PHP #RCE last week, I've been preparing a tool for everyone who doesn't know what to do right now: process-watcher shows you every program your PHP processes start, with full command lines, so you can spot suspicious activity Until a patch is out, isolation (containers) and tight monitoring are your best bet to limit the damage. And I'm sure the LLMs already go "brrrr" and people are trying to reproduce the vulnerability. From what I've heard, exploitation will probably show up as suspicious sub process spawns. That's exactly what this watches, using eBPF: one static binary for Linux (amd64, arm64), no dependencies, running in a few minutes. It can also kill the ones you name (dry run first), but it's a detection layer, not a patch, and it can't see anything that happens inside PHP without starting a process. Quick start: github.com/Neo23x0/process-w… Project: github.com/Neo23x0/process-w…