tl;dr: PHP released emergency patches (8.5.12, 8.4.27, 8.3.36, 8.2.35) for two critical RCE vulnerabilities in memory management and error handling, both exploitable unauthenticated on Apache/mod_php with default settings. The OOM-related bug was first spotted in 2024 but languished for months due to a resource-starved, consensus-bound security team struggling with compatibility trade-offs, until external auditors (Calif, OpenAI, Wiz) independently rediscovered it in August 2026. Disclosure was marred by a leak and Chainguard breaking embargo six hours early; the PHP Foundation is pleading for sustained corporate and government sponsorship to fund deep-engine security expertise.