[CRITICAL] CompilerRuntime code injection via unescaped function names

PKSA-mnyp-475s-ywph CVE-2026-54133 GHSA-pcw8-m77r-2528

Affected package: mtdowling/jmespath.php

Affected version: <2.9.1

Reported by:
GitHub, FriendsOfPHP/security-advisories