I took my services offline last night, wouldn't have been able to sleep otherwise. There has been core PHP members that have outright said the mitigation's currently doing the rounds won't help and even cloudflare can only mitigate against known attack payloads.
The maintainer's comments are singularly unhelpful - "there's nothing you can do, just curl up and die" is pretty useless when you're faced with "take the entire company site offline" vs "maybe get exploited."
The comments aren't unhelpful, they're in fact very helpfully telling you that "take the entire company site offline" is the only safe choice right now.
So what if there are no known mitigations and it's such an open attack surface that logging doesn't help in containing it?
Since you wrote your comment the official blog posts describing what exactly is the in the exploit have been released, and "shut it all down" was definitely the right advice to give.
Yes, that's not very well done: when you are handling big IT services, you need more than "a person wrote a scary thing on twitter" to justify such an impacting action
