@soulofnone 1 hr is kinda average, depending on the composition and details. The point of this exercise is to train myself to draw complicate setups without thinking too much about it looking good (which make it slow).
The PHP security team is giving advance notice: Upcoming security release Wed, Oct 21st 2026, 14:00UTC, two critical vulnerabilities, both rated CVSSv4 9.2.
PHP users are encouraged to prepare to update. Earlier release if details become public or active exploit evidence.