PHP team warns of two critical flaws ahead of October 21 release
Original title: Upcoming Critical PHP Security Release
Both issues are rated CVSS v4.0 9.2, and affected and fixed versions will be published with the 14:00 UTC release.
The PHP security team gave advance notice of a security release scheduled for Wednesday, October 21, 2026, at 14:00 UTC. It will address two critical vulnerabilities. All PHP users are asked to prepare so they can upgrade as soon as the packages are available. The team may release earlier if details become public or evidence of active exploitation appears.
Unconfirmed: Vulnerability details, affected versions and fixed versions have not been published, and no exploitation is described.
- Both vulnerabilities are rated CVSS v4.0 9.2.
- Affected versions and fixed versions are withheld until release.
- An earlier release is possible if exploitation evidence appears.
- The notice does not name the vulnerabilities or attack impact.
| Product | Affected |
|---|---|
| PHP Group PHP | — |
- 1.Prepare to upgrade PHP as soon as the October 21 security release is available.
From the original article
15 min read at php.net
Here are the most important news items we have published in 2026 on PHP. net. The PHP security team would like to give advance notice of an It is scheduled for Wednesday, 21 October 2026 at 14:00 UTC.
By choult · php.net
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.