Two critical PHP vulnerabilities (CVSS 9.2) were disclosed today, allowing unauthenticated RCE on default configurations.
To help everyone patch fast we are making images for PHP 8.2, 8.3, 8.4, and 8.5 free for anyone to use. You can access them here:
Coordinated disclosure is hard, we appreciated everyone's help as we worked through this over the last several days.