While many infosec "professionals" are spouting the same tired old hot takes that we can expect from social media, I do want to say that I appreciate the PHP team for putting out backported fixes for their older versions of PHP going back to 7.4. They didn't have to, but they did.
It would be good if distro vendors will be picking these up, but there is a way forward for many old installs.
7.4: https://github.com/php/php-src/tree/PHP-7.4-CVE-2026-109618-109619
8.0: https://github.com/php/php-src/tree/PHP-8.0-CVE-2026-109618-109619
8.1: https://github.com/php/php-src/tree/PHP-8.1-CVE-2026-109618-109619