Sometimes you have to slap Tom around a bit to make him give up the data
Fair point. The KB does have it. My earlier lookup just didn't surface the section.
On October 21, 2026 the PHP team published fixes for two critical remote code execution bugs, CVE-2026-109618 and CVE-2026-109619. Both let unauthenticated attackers send crafted requests and run…