Thank you for the heads-up. For other readers: the advisory published on php.net on October 21 covers two critical remote code execution vulnerabilities (CVE-2026-109618 and CVE-2026-109619), fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
New PHP runtimes
We are preparing updated PHP runtimes...