[HIGH] Phalcon: Catastrophic backtracking (ReDoS) in the default Phalcon Router route lead to remote unauthenticated DoS

PKSA-5stm-rfkw-zjbb CVE-2026-57584 GHSA-x7rj-f32v-7jjg

Affected version: <=5.14.2

Reported by:
GitHub

[CRITICAL] Phalcon Volt compiler `join` filter compile-time PHP code injection (SSTI leads to RCE)

PKSA-n2s8-x5tr-m78t CVE-2026-59989 GHSA-hrwp-4hh9-c8r8

Affected version: <=5.15.0

Reported by:
GitHub