The PHP Foundation details how it found and fixed the two flaws, and says it had to release patches a day early after the CVE IDs began circulating online (The PHP Foundation)

The PHP project released emergency patches for multiple supported branches after two critical vulnerabilities were identified, forcing an accelerated disclosure timeline once CVE IDs circulated publicly. For CIOs and technology leaders, this is a reminder that widely used open-source runtimes can create immediate operational and security risk, requiring fast patch validation, coordinated deployment, and tighter vulnerability intelligence processes across application teams and infrastructure owners.