https://www.php.net/archive/2026.php#2026-10-21-5

> PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly encouraged to update immediately.

Earlier versions are not fixed by PHP official and need vendor patching where available