A high-severity TLS stream flaw and a heap-corruption bug in PHP’s OpenSSL extension now push operators to verify patched builds across supported branches.