Hello,
> On 21.10.2026 16:44 CEST Jakub Zelenka <[email protected]> wrote:
>
> Affected versions are PHP 8.2 before 8.2.35, PHP 8.3 before 8.3.36,
PHP 8.4
> before 8.4.27, and PHP 8.5 before 8.5.12.
it might worth to mention that the subject as well as the text here
could imply / be interpreted that only PHP 8.2-8.5 are affected (and
older versions not).
But at least https://www.php.net/archive/2026.php#2026-10-21-5 mentions
the availability for backports down to PHP 7.4 which implies that at
least versions down to 7.4 are affected as well:
> Given the severity of these vulnerabilities, the PHP security team
> provided minimal source-backports for PHP 7.4, PHP 8.0, and PHP 8.1 to
> help people building from source or without access to an LTS vendor.
Regards
