not particularly end user related, but since i know a lot of us have personal/blog websites and if you haven't seen it:
php.net/index.php#…
.. actively being exploited now, Cloudflare put in some emergency rules to mitigate some of it but it's a RCE (as i sit here anxiously waiting for the fixes to get upstream to my various docker images i pull 😄 )