That partial stack trace linked above seems to match this GitHub issue, which has much more information: https://github.com/php/php-src/issues/24488 (double-free introduced in 8.5.12)

From what I can see, this causes a crash only, and isn't weaponisable. It's a use-after-free, but the reclaim window is zero by construction.

Mr. President...

Is there anywhere good to get some sort of reliable stream of information about this possibility?

It's going to be pretty bad if we all panic to get the latest PHP up, and all confidently roll out our updated websites, just for them to still be vulnerable to something serious anyhow.

This is why I like to have a minimum age requirement on package releases. Something like at least 2 or 3 days.

Anymore on this, I'm upgrading to 8.5.12 now and don't want to still be vulnerable?