phalcon cphalcon

• CVE-2026-59989 Critical 9.2 Phalcon Volt compiler `join` filter compile-time PHP code injection (SSTI lead to RCE) 0.5%
• CVE-2026-57584 High 8.7 Phalcon: Catastrophic backtracking (ReDoS) in the default Phalcon Router route lead to remote unauthenticated DoS 0.5%
• CVE-2026-54736 High 8.2 Phalcon: Non-constant-time HMAC verification in `Encryption\Crypt::decrypt` (timing side-channel) 0.2%