From the article: But there is hope! PHP already landed a change (which will ship with PHP 5.3.9) ... As far as I can tell, this isn't being backported.

From the article: But there is hope! PHP already landed a change (which will ship with PHP 5.3.9) ... As far as I can tell, this isn't being backported. This is going to be bad. I've never had the privilege of using PHP 5.3 during work hours; everything has always been stuck on 5.1.6 and 5.2.x. Predictions: a) People are going to jump to 5.3 in a hurry, or b) RedHat will release a backport for RHEL (and Centos will release the patch in six months). Either way, I think this will go unpatched in a large number of systems until DoS attacks become so common that a) and b) will need to happen.