The PHP releases of 21 October 2026 fix two critical vulnerabilities, and you should update now.

@thephpf itself calls the time the fix took a structural failure, one that was also caused by a lack of resources.

The hate now being poured over PHP changes nothing about that; broader funding would:

https://phpunit.expert/articles/hate-does-not-fix-vulnerabilities.html?ref=mastodon