The PHP Foundation says its patches for the RCE vulnerabilities are limited to PHP 8.2 and newer, leaving legacy deployments dependent on third-party vendors (Wired)

The PHP Foundation’s decision to limit official RCE fixes to PHP 8.2 and newer creates immediate operational and security risk for organizations running older PHP versions, which may include critical legacy applications and websites. For CIOs and technology leaders, this increases exposure to exploitation, places greater dependence on third-party patch providers, and underscores the strategic need to accelerate application modernization, reduce unsupported software sprawl, and improve software asset visibility across the IT estate.