What I did to get the CVE-2026-109618 and CVE-2026-109619 fixes into a PHP 7.4 container, in case anyone else has legacy PHP codebases that refuse to die.