PHP has now published its full security advisory, with patches for CVE-2026-109618 and CVE-2026-109619 as well as mitigation measures to take in order to mitigate the risks.

https://www.php.net/