It's a very different shape to the other two CVEs, and a use-after-free doesn't necessarily immediately imply a critical CVE.
> Elise: confirmed working on 8.5.10 too
That's... not a particularly unusual issue. PHP has a large codebase, releases with plenty of fixed crashes come out regularly. It becomes critical if there's a remote path to exploitation.
I see no indication that this is a "critical" PHP flaw. And the Reply from the person who found it seems to confirm that. ("I keep getting asked about mitigations, here's the mitigation: don't worry about it kitten")
It found nothing.
Take that for what it is.
Together with https://www.openwall.com/lists/oss-security/2026/10/21/23 you're probably not going to need to stay up for this.
honestly, i would just wait for php announcement and assume its no big deal until then.