Patched

Two critical PHP remote code execution flaws (CVE-2026-109618, CVE-2026-109619) are fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. ForgeKit ships them out of the box.