PHP released updates across its entire 8.x line on October 21, a day early, to fix two remote-code-execution flaws rated 9.2. Their CVE IDs leaked on October 20, and a mistakenly published proof-of-concept video accelerated exploit development, with working PoCs circulating before the patches arrive