boris wrote
the PHP pre-configured packages you have available contain OpenSSL 1.0.1f (the vulnerable versions), not the 1.0.1g
I realize PHP has not released a new version of PHP, but your pre-configured packages should probably be rebuilt ? :)
Replacing the OpenSSL DLLs with those in the package linked to above is the way to go. Please note also that unless you're writing a server software with PHP (in which case you're not doing simple PHP Web scripting), you won't have any issue with that language. Heartbleed is bug with a limited scope and it doesn't include general PHP scripting.