PHP to fix two CVSS 9.2 flaws on October 21
Original title: Upcoming Critical PHP Security Release
The PHP security team may publish earlier if details leak or exploitation appears.
The PHP security team said a release will address two vulnerabilities, each rated CVSS v4.0 9.2, Critical. It is scheduled for 14:00 UTC on October 21, 2026. Users are told to prepare so they can update as soon as it is available.
Unconfirmed: The flaws, affected versions, and any real-world exploitation are not disclosed.
- No CVE identifiers or affected version ranges are named.
- An earlier release is reserved if either flaw's details go public.
- The notice does not report current exploitation.
| Product | Affected |
|---|---|
| PHP | — |
- 1.Prepare to update PHP as soon as the security release is available.
- Vendors
- PHP
- Organizations
- PHP security team
From the original article
1 min read at news-web.php.netWe want to inform you of an upcoming PHP security release that addresses two critical vulnerabilities (both rated CVSS v4. 0 9. 2, Critical).
By xd · news-web.php.net
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.