PHP Security Team Issues Advance Notice for Release Addressing Two Critical Vulnerabilities

Release Targets Two Flaws Rated CVSS 9.2

The PHP security team has issued advance notice of an urgent security release scheduled for Wednesday, October 21, 2026, at 14:00 UTC. The upcoming update addresses two critical vulnerabilities, each rated at 9.2 under the Common Vulnerability Scoring System (CVSS) v4.0.

Technical details regarding the vulnerabilities, affected versions, and patched releases will be made public alongside the release. However, the team stated that it reserves the right to issue the patches earlier if technical disclosures leak publicly or if evidence of active in-the-wild exploitation emerges prior to the scheduled window.

Immediate Preparation Advised for System Administrators

Because PHP powers a substantial portion of the global web infrastructure, including content management systems such as WordPress and Drupal, administrators are urged to prepare their environments to apply updates as soon as they become available.

• Identify active PHP branches across all production and development servers
• Verify backup routines and deployment testing workflows ahead of the release
• Plan migration steps for legacy systems running unsupported end-of-life versions