PHP core developers themselves are telling people the safest option is to take their site offline.

Security researchers expect mass attacks within 15 minutes of disclosure.