it's PHP that needs the patches. Yes you should take the site down until PHP has been patched.

edit: assuming you are hosting wordpress yourself. if you're using a large 3rd party service that manages PHP itself like wordpress themselves, one should hope that they will be updating PHP early, before the patch is even released publicly.