PHP warns it plans to release 2 emergency patches imminently

Ars Technica security feed covering alleged and confirmed vulnerabilities, active exploitation, certificate authority compromises, privacy incidents, AI-agent abuse, malware delivery, and major breaches. Several reports describe critical risks including remotely exploitable server flaws, fraudulent TLS certificates, exploited Plex and Zimbra vulnerabilities, zero-click mercenary spyware, and large-scale account compromise. Many items are forward-looking, theoretical, or unconfirmed; no specific CVE identifiers are provided in the feed metadata.