That blog post is *really* light on details. Maybe they assume readers will already know what to expect?
This page appears to be the official list of everything that's coming with 6.8 next week: https://community.kde.org/Plasma/Plasma_6
Things that stood out to me include removal of X11 as a default option at login, triple buffering enabled for Nvidia, Remote Desktop improvements including 2-way clipboard, improvements to screen recording including recording audio and better screen casting performance.
And finally "Shadows and rounded corners for Steam". Steam has always been visually quirky to say the least, so I'm intrigued to find out if this will be an improvement or not.
it's PHP that needs the patches. Yes you should take the site down until PHP has been patched.
edit: assuming you are hosting wordpress yourself. if you're using a large 3rd party service that manages PHP itself like wordpress themselves, one should hope that they will be updating PHP early, before the patch is even released publicly.