[geckoday]

Thanks for the heads up rrf.

For those of you whose servers are in scope for your PCI-DSS assessment this means you must upgrade. Its unclear whether or not this would be classed as a critical security patch so installing within the 1 month requirement for critical security patches would be prudent. If you are running PHP 5.2 then this means you need to upgrade to 5.3 pretty quickly. I think you could make a case for going to 5.2.14 within 1 month and then to 5.3.3 within the next month. But thats about it for 5.2 since there is no guarantee of future security patches.