I consider it OUTRIGHT IMPLAUSIBLE that the PHP vulnerabilities have anything at all to do with this, as I have already explained (mind you it's a long post; about 2400 words). To make a long story short, the impact and exploitability of this vulnerability have been blown completely out of proportion. There's no publicly known working exploit yet. The only exploits witnessed in the wild are merely stage 1; they don't get stage 2 which is code execution. It's a bit like having a gun, a bullet casing, and gunpowder, but no actual bullet, just a wad of paper. It's still scary and stings a bit, but it can't kill you even in point blank range.
What I cannot discount is the possibility that your own host may have hastily done something unadvisable, e.g. applying mitigations and patching PHP which is simultaneously pointless and site-breaking, as I have explained in the same news article I linked above.
It might also be a very mundane problem we've seen before: a badly compiled version of PHP is crashing hard ("dumps core" as we used to call that back when). The latter case would mostly fit your description as it may not leave a trace in the virtual host's error log (what you see), only in the main Apache error log (what your host sees), depending on virtual host configuration.
A combination of all of the above would actually fit your description very well. Part of the mitigation is disabling PHP error exception backtraces, which makes it impossible for Joomla to show an error screen with the exact problem and code location when PHP code fails. Since it's an unconditional check, it might lead to a hard PHP crash under certain circumstances, which would lead to a 500 error page from your host. It's a stretch, but it's a plausible explanation.
As a side note, the PHP warnings you get are not from our software, they're from the NovaRain Framework which is used by Tassos' extensions. We're one country over to him, and a completely different company :)
I would very strongly recommend setting Error Reporting to None and Debug Site to No – the recommended production site values. Then, contact your host and ask them to check the error. This will work best if you record the exact date and time you get the error, as it will let your host narrow down their search within the Apache and PHP log files to just a few dozen to hundred lines. Their investigation becomes more like finding a book in a bookshelf than a needle in a haystack.
Nicholas K. Dionysopoulos
Lead Developer and Director
🇬🇷Greek: native 🇬🇧English: excellent 🇫🇷French: basic • 🕐 My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!