So apparently there's a PHP remote code execution zero vulnerability going to be released (and patched) on Thursday going back to PHP 5+ 😬
Commit
f619662
Details before the patch. Worst possible order.
Two of them, apparently
https://www.cve.org/CVERecord?id=CVE-2026-109618
https://www.cve.org/CVERecord?id=CVE-2026-109619
commit f619662