A reliable source has indicated an announcement is scheduled for 22 October 2026 at 18:00 CEST regarding 2x PHP RCEs with a CVSS score of 10. 0. I have no evidence beyond "source: trust me, bro", but if you're running PHP in production, be ready to update as a priority.
Source: [Hacker News](https://news.ycombinator.com/item?id=50167754)