Resolved: every PHP site on Vallic, and our console, now runs the patched PHP releases (8.5.12, 8.4.27, 8.3.36, 8.2.35) for CVE-2026-109618 and CVE-2026-109619. A mitigation was in place on all sites since this afternoon. No action needed on your side.
We are compile and test updated image versions to apply the PHP security releases.
No write-up yet. Saying so is better than pretending the story is finished.