heteml (GMO Pepabo): security status

Summary

Official report (Oct 22 18:05): PHP 8.2-8.5 updated to the upstream fixed releases (8.2.35/8.3.36/8.4.27/8.5.12); 7.4/8.0/8.1 received the upstream fix code for EOL branches; 5.6-7.3 received heteml's own fix based on the upstream one. session.upload_progress is disabled on every version. Sites were taken offline per server from about 03:05 on Oct 22 and restored at about 11:24. Exploit attempts were seen, but no unauthorized access or data leak has been confirmed. Because the older branches were patched in place, the notice does not say whether their displayed version number changes.