Critical 9.5 Severity: PHP SOAP Extension Flaw Enables Remote Code Execution

This advisory details multiple security vulnerabilities across PHP versions (including 8.2, 8.3, 8.4, and 8.5), highlighting a critical SOAP extension use-after-free (CVE-2026-6722, CVSS 9.5) that can lead to remote code execution, an XSS on the PHP-FPM status page (CVE-2026-6735, CVSS 7.3), and several lesser but impactful bugs causing crashes or denial-of-service; administrators are urged to update to the patched releases (8.2.31, 8.3.31, 8.4.21, or 8.5.6) immediately.