Based on https://github.com/zendframework/zend-form/releases/tag/release-2.3.6 (commit ab52a58728aeb6df3a779ff35a221cec06dae660 in this repo)

SECURITY UPDATES
----------------

- **ZF2015-03** `Laminas\Validator\Csrf` was incorrectly testing null or
  improperly formatted token identifiers, allowing them to pass validation. This
  release provides patches to correct the behavior. If you use the validator, or
  the corresponding `Laminas\Form\Element\Csrf`, we recommend upgrading
  immediately.