Two critical flaws in the PHP interpreter itself leaked a day before their planned disclosure. On 21 October, public bodies in several European countries took websites offline as a precaution. Our incident report reconstructs what happened, explains the causes and lists what every operator of a PHP website should do now.