1 source filed · EN 1
Late reverts between 27 August and 15 September: UPDATE/DELETE FOR PORTION OF, SQL Property Graph Queries (SQL/PGQ), and ALTER TABLE MERGE/SPLIT PARTITION.
724 ... 1169commits to the new stable branch between feature freeze and 25 September, 2025 against 2026
2 sources filed · EN 2
CVE-2026-109618: hitting memorylimit at the wrong moment leaves partly initialised data; on Apache with modphp, an unauthenticated request triggers it before application code runs, with RCE shown on default settings.
15CVEs published by the PHP security team since 1 July 2026
Reports deemed LOW or MEDIUM that arrive on HackerOne will be closed as informative, publicly disclosed, and the reporter asked to resubmit on GitHub.
over 90%share of submissions in recent years quickly assessed as below HIGH severity