- Platform/SRE — Skip
- CI/CD — Plan: Two critical PHP CVEs affect Docker images built on PHP; audit pipelines for PHP-based container images and update base images to patched PHP versions. Neither CVE is KEV-listed and EPSS scores are low (0.12/0.06), so no emergency, but schedule the base-image refresh this sprint.
- Leader — Skip
- Signals: CVE-2026-109618 — CISA KEV: not listed, EPSS 0.12, reported by 2 collected sources · CVE-2026-109619 — CISA KEV: not listed, EPSS 0.06, reported by 2 collected sources