PHP.net lists PHP 8.5.6, released May 7, as a security release and tells PHP 8.5 users to upgrade. The exact exposure depends on the fixes in your runtime line, but the operational lesson is familiar: security releases only help once the boring inventory work is done.
For Alex's world, this means checking local containers, CI images, Forge or Cloudways-style servers, and any client environments that quietly pin a patch version. It is also a good excuse to confirm who owns runtime patching on each retainer.