If you run PHP 7.4, 8.0 or 8.1, no patch is coming for this one. Not late. Never.
On 21-23 October two critical remote code execution flaws landed in PHP core: CVE-2026-109618 and CVE-2026-109619, CVSS 9.2. Unauthenticated code execution on anything web-facing: mod_php, PHP-FPM, php-cgi, FrankenPHP, LiteSpeed. CISA and CERT-EU both say patch immediately, and exploit attempts are already being reported.
Emergency fixes went to the supported branches only: 8.5.12, 8.4.27, 8.3.36, 8.2.35. Anything older gets nothing.
That gap matters more than the CVSS score does. A bug has a fix date. An unsupported branch has no fix at all, so this stops being a patching job and turns into a stack decision.
Three things worth doing today if you stay on PHP:
Move to a patched 8.2+ build.
Set session.upload_progress.enabled=0 in php.ini, the only mitigation for the third flaw, CVE-2026-115560, disclosed 23 October with no patch yet.
Check what your hosting vendor has actually patched, not what the status page claims.
And if the honest answer is that this service should come off PHP entirely: send it to me today and within one day I will tell you what moving it to a supported, modern stack costs and how many weeks it takes. Small services come off in days, not months. I have done legacy rewrites before.
Message me.