@ilpianista @caoimhin @jolla They do have a heads up message an https://openrepos.net/ which is better than nothing - but still concerning!:

Hi, as you might have heard, CVE-2026-109618 and CVE-2026-109619 has been identified in PHP.
While impact is being assessed, openrepos is in read-only mode.