PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 were just released to fix two critical vulnerabilities that can allow for unauthenticated remote code execution. Server administrators are advised to update immediately.
The first vulnerability is out-of-memory handling can interrupt PHP causing OOM corruption and remote code execution. The second remote code execution vector is via stale global state surviving after its backing memory has been freed.
Both of these remote code execution vulnerabilities are rated critical at 9.2 out of 10.
More details on these security vulnerabilities and the updated PHP versions at PHP.net.