TLDR: multiple CVEs, both with a high score, leading to remote code execution vulnerability. Please read the official advisory.
Update: Fedora has the update as well. Mirrors are slow to sync, here’s one that works (/etc/yum.repos.d/fedora-updates.repo):
[updates]
#metalink=https://mirrors.fedoraproject.org/metalink?repo=updates-released-f$releasever&arch=$basearch
baseurl=https://mirror.fcix.net/fedora/linux/updates/$releasever/Everything/$basearch/Debian allegedly already updated, Fedora is not, at the time of writing. Cloudflare is actively trying to filter this attack already.
Until then, the workaround is to put this in your /etc/php.d/99-php2shell.ini:
; Disables the session upload progress component entirely (blocks a key RCE vector)
session.upload_progress.enabled=0
; Blocks the confirmed fatal backtrace path only
fatal_error_backtraces=0
; Prevents the application from overriding standard memory limits
memory_limit=-1
; Sets low post_max_size and even lower upload_max_filesize
post_max_size=8M
upload_max_filesize=4M
Restart your PHP-FPM or whatever you’re using, and make sure to verify the changes with phpinfo() or something like:
php-fpm -i | grep -E "upload_progress.enabled|backtraces|^memory_limit|max_filesize|post_max_size"