On October 21, 2026, the PHP development team announced a critical emergency vulnerability (CVE-2026-109618 / CVE-2026-109619 ...