Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilityhigh

PHP schedules critical security release for two 9.2 flaws

2 sources · 2 articlesFirst reported Updated ()1
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

PHP plans a critical release at 14:00 UTC on October 21, 2026, for two undisclosed 9.2 flaws, with no exploitation reported.

The PHP security team said it will publish a security release at 14:00 UTC on October 21, 2026, addressing two vulnerabilities, each rated Critical at CVSS v4.0 9.2. The notice does not name CVE identifiers, describe the flaws, or list affected or patched versions; those details are expected with the release. Administrators are told to prepare so they can update as soon as packages are available. The team may publish earlier if details leak or exploitation appears. The notice does not report current exploitation. Help Net Security says security fixes normally go only to PHP 8.2 through 8.5.

Key facts
  • Two vulnerabilities, each CVSS v4.0 9.2 Critical, are the release target.
  • Release is set for 14:00 UTC on October 21, 2026, or earlier if details leak or exploitation appears.
  • No CVE identifiers, flaw descriptions, or affected version ranges are named.
  • Patched version numbers are to be published with the release.
  • No current exploitation is reported.
  • Security fixes normally cover only PHP 8.2 through 8.5, according to Help Net Security.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Oct 20, 2026PHP announces a critical security release for two flaws. · Hacker News
  2. Oct 20, 2026oss-security forwards the PHP.net archive notice. · oss-security
  3. Oct 21, 2026Release scheduled for 14:00 UTC; details still unpublished. · Help Net Security

What each outlet adds

beyond the shared facts
  • Hacker NewsNo CVEs or ranges named; no exploitation reported; earlier release if details leak.
  • oss-securityAlan Coopersmith forwarded PHP archive entry 2026-10-20-1 only.
  • Help Net SecurityPatched versions come with the release; fixes normally cover PHP 8.2–8.5.
Vendors
PHP
Organizations
PHP security team

Coverage

oldest first · one row per article · UTC
  1. · 22d ago Hacker News · securityFirst report

    PHP to fix two CVSS 9.2 flaws on October 21

    The PHP security team may publish earlier if details leak or exploitation appears.

  2. · 22d ago oss-security

    PHP flags an upcoming critical security release

    The oss-security note only points to a PHP.net archive entry and gives no flaw details.