PHP schedules October 21 security release for two critical vulnerabilities

In an Oct. 20 advance notice, the PHP security team scheduled an Oct. 21, 2026, release for 14:00 UTC and rated both vulnerabilities 9.2 under CVSS v4.0. It asked users to prepare to upgrade and said affected and fixed versions would be disclosed with the release. watchTowr described the flaws as remote-code-execution vulnerabilities, but PHP's notice did not provide technical details.