We have updated our web servers to run PHP 8.5.12 to mitigate two critical vulnerabilities that can allow unauthenticated remote code execution. As there breaking changes between 8.5.12 and prior versions site owners will need to audit and resolve regressions. - RCE via OOM corruption, CVE-2026-109618 - RCE via stale global state, CVE-2026-109619