PHP security team schedules critical release for October 21
Original title: A critical PHP security release is coming today, so get ready to update!
Two flaws each scored 9.2 will be detailed with patched versions at 14:00 UTC, or sooner if they leak.
The PHP security team announced an urgent security release for Wednesday, 21 October 2026 at 14:00 UTC. It fixes two vulnerabilities, each rated 9.2 Critical under CVSS v4.0. The notice does not describe the flaws or say which versions are affected; those details and patched version numbers will be published with the release. Administrators are urged to prepare so updates can be applied immediately.
Unconfirmed: Affected versions, flaw details and patched version numbers have not been published.
- Each vulnerability is rated 9.2 Critical under CVSS v4.0.
- Patched version numbers will be published when the release goes out.
- The team may release earlier if details leak or exploitation is found.
- Security fixes normally go only to PHP 8.2 through 8.5.
| Product | Affected |
|---|---|
| PHP | — |
- 1.Inventory PHP installs and plan a maintenance window shortly after 14:00 UTC.
- 2.Ask shared or managed hosts when they will deploy this release.
- 3.Plan a branch upgrade if the site runs a version older than supported PHP 8.2 through 8.5.
- Vendors
- PHP
- Organizations
- PHP security team
From the original article
1 min read at helpnetsecurity.com
The PHP security team has announced an urgent security release for Wednesday, 21 October 2026 at 14:00 UTC. The release fixes two vulnerabilities, each rated 9. 2 (Critical) under CVSS v4.
By Mirko Zorz · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.