[HIGH] OS Command injection

PKSA-rdkp-vv9z-mjkg CVE-2026-67434 GHSA-hmqg-cxww-wqhq

Affected version: <3.13.6|>=4.0.0,<4.0.2

Reported by:
GitHub, FriendsOfPHP/security-advisories