PHP schedules October 21 security release for two critical vulnerabilities

On Oct. 20, 2026, the PHP security team gave advance notice of a security release scheduled for Oct. 21 at 14:00 UTC to address two critical vulnerabilities. It rated each 9.2 under CVSS v4.0 and asked PHP users to prepare to upgrade as soon as the release became available.

The team said full details, affected versions and fixed versions would be published with the release. It reserved the right to release earlier if details of either vulnerability became public or evidence of active exploitation appeared in the wild.

Reports go beyond PHP's notice

Lawrence Abrams of BleepingComputer reported that information about the flaws had reportedly leaked. watchTowr CEO Benjamin Harris told the outlet the vulnerabilities were remote-code-execution flaws understood to affect PHP versions 5, 6, 7 and 8. Remote code execution could let an attacker run code on an affected server, according to , which says a PHP advisory had not confirmed the technical cause or version range.