PHP
PHP2Shell: Two Unauthenticated RCEs in PHP Core, Reachable Before Your Code Runs
The PHP project shipped fixes for two CVSS 9.8 core vulnerabilities that let an unauthenticated request execute code before any application code runs. If you run self-hosted PHP, update now. The partial mitigations are stopgaps.