Just to add: there was an embargo on releasing the patch and information about the patch, but some website or something broke the embargo.

That meant that malicious people could read what the patch was doing and understand how to exploit the issue/bug.

Edit: all the details are here: https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/