Not sure exactly which version of PHP Allspark uses(a plus I suppose that the version isn't publicly embedded in the headers) but there's a major unauth RCE that just got patched for all versions.
https://www.php.net/index.php#2026-10-21-5
You all may already be aware, just passing it on just...