1 article on this topic.
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. Both are memory-lifecycle bugs in request handling, so the exposure sits in the runtime rather than in your application code.