Both PHP flaws sit in the part every request touches. The Foundation says the fix for one of them stalled for months
2026-10-23Security
The technical reason is memory management and error handling. The organisational reason is in the post-mortem, which calls the delay a structural failure. And the emergency release carried a second heap corruption nobody was looking for.