Symfony's October Security Releases: Three Ways a Single Request Can Hurt You
On October 14 and 15, Symfony shipped a coordinated set of maintenance releases across every supported branch: 5.4.54, 6.4.48, 7.4.21, and 8.1.9. Between them they close three CVEs, all rated high severity, and all with the same uncomfortable shape: a single HTTP request, no authentication, no special configuration, and the PHP process either burns a CPU core or falls over.