[CRITICAL] Phalcon Volt compiler `join` filter compile-time PHP code injection (SSTI leads to RCE)

PKSA-n2s8-x5tr-m78t CVE-2026-59989 GHSA-hrwp-4hh9-c8r8

Affected package: phalcon/cphalcon

Affected version: <=5.15.0

Reported by:
GitHub