The PHP security team announced on October 20, 2026, that it scheduled fixes for two critical vulnerabilities. The release was scheduled for October 21, 2026, at 14:00 UTC. PHP rates each vulnerability at 9.2 under the Common Vulnerability Scoring System v4.0. Sources: PHP
PHP’s advance notice announced a scheduled security release. The notice did not identify affected or fixed versions, attack mechanisms, affected configurations or Common Vulnerabilities and Exposures (CVE) identifiers. PHP says it will publish version information and full details with the release. Sources: PHP
PHP said it could release the fixes earlier if vulnerability details became public or evidence of active exploitation emerged. Those conditions do not establish that vulnerability disclosure or exploitation has occurred. Sources: PHP
To prepare for the security release, BuildRiot recommends that teams inventory PHP runtimes across servers, containers and managed hosting. Teams should record versions and update sources, assign patch owners, and prepare testing, rollout and verification plans. Owners should monitor upstream announcements, distribution packages, container images and hosting-provider updates. PHP says it will publish affected-version information at release. BuildRiot recommends comparing runtime inventories with that information. Sources: PHP