The PHP project fixed two critical vulnerabilities that affect any PHP application, not only WordPress. No WordPress update is required. PHP versions before 8.2 no longer receive security updates from the PHP project.
Update PHP on every server now and move sites off PHP 8.1 or older (check Tools → Site Health → Info → Server).
WordPress 7.0 dropped PHP 7.2 and 7.3; the minimum is now PHP 7.4.0 and the recommended version stays 8.3. Sites on PHP 7.2/7.3 stay on the 6.9 branch. Core is fully compatible with PHP 8.0 to 8.3 and has beta support for 8.4 and 8.5. The Gutenberg plugin also requires PHP 7.4.
Set Requires PHP: 7.4 or higher for code that targets WordPress 7.0+, and test on PHP 8.4 and 8.5.