Comment According to the notes, it isn't in the wild (Score 2) 31
The patch notes say both vulnerabilities will be fixed on Oct 26 unless it's seen in the wild before that.
I've had trust issues with PHP using software since one piece I installed wanted to run web files root. Just no. Web server files are owned by the web user and can't touch anything else on the Raspberry Pi it runs on. That is not PHP though, just developers that don't think of security first using PHP.