For anyone else looking for PaloAlto's notice, it's here:
https://security.paloaltonetworks.com/CVE-2026-109618
I'm waiting for it to say something other than ETA: TBD
Had a hard time finding it initially because google wants to send you to their unit42 writeup that covers their take on them protecting you from everyone else instead.