Debian has, though only for current stable (updates for oldstable and oldoldstable apparently about to drop) which might imply they had no advanced access to the update so could not pre-test and release immediately upon the coordinated announcement.

Not true. I was able to `aptitude update` and `aptitude full-upgrade` before 10:00 AM EST (9:50 AM) and received the new php8.* packages and upgraded fine.

I had an email from usn recently

at 15:00 UTC, spot checking, Debian 13 has a fix, Ubuntu 26.04 has a fix with their own patch version number, Fedora does not.

Ubuntu: https://ubuntu.com/security/notices/USN-8948-1

Fedora package status: https://packages.fedoraproject.org/pkgs/php/php-fpm/