Looks like in addition to the recent SSL/TLS and PHP vulnerabilities there's also an RCE in BIND:
https://lists.isc.org/pipermail/bind-announce/2026-October/001306.html
(Though I'm not sure why someone would be using BIND in 2026, I stopped around 2001 or so)