PHP project will avoid another critical security disclosure

No critical PHP vulnerability will be publicly disclosed that meets the CVE and CVSS criteria before December 31, 2026. PHP administrators will instead focus on patching the October 21 releases of versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 that addressed CVE-2026-109618 and CVE-2026-109619. The pu…