The base patches are available but that might not have filtered through to all places where PHP is packaged as part of something else.
If you’re behind Cloudflare then they have a WAF protection in place to buy you some time to update.
I’m making progress. I have a new image built but it wasn’t used at first because the system wasn’t downloading the new version....