I have no evidence beyond "source: trust me, bro", but if you're running PHP in production, be ready to update as a priority.
These CVEs reportedly relate to remote code execution in all affected PHP versions from PHP 5 onwards.
These are the two reserved CVEs for the reported upcoming announcement:
CVE-2026-109618
CVE-2026-109619