Yikes.
https://www.bleepingcomputer.com/news/security/php-warns-admins-of-two-critical-flaws-emergency-patches-coming-tomorrow/amp/
It was OpenAI that found the flaw.