The PHP security team has announced an urgent security release for Wednesday, 21 October 2026 at 14:00 UTC. The release fixes two vulnerabilities, each rated 9.2 (Critical) under CVSS v4.0. The notice doesn’t yet describe the vulnerabilities or say which PHP versions they affect.
A critical PHP security release is coming today, so get ready to update!
About this summary. This is a short excerpt from the description that Help Net Security published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://www.helpnetsecurity.com/2026/10/21/php-security-release-announcement-october-2026/
Source attribution: headline and facts are from Help Net Security (helpnetsecurity.com). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
‘This Is Not A Drill’: Critical PHP Vulnerabilities Are Setting the Internet on Fire
The PHP Foundation has revealed two serious vulnerabilities that could impact millions of websites. Security experts warn that failure to quickly patch the flaws could…
Hundreds of websites taken offline as concern grows over two PHP vulnerabilities
The maintainers of the globally used PHP scripting language released patches for two vulnerabilities after alerting users that the bugs were severe.
Critical PHP Vulnerabilities Leaked Ahead of Scheduled Security Patches
Two critical vulnerabilities in PHP were leaked one day before their scheduled disclosure and security patches
PHP warns admins of two critical flaws, emergency patches coming tomorrow
The PHP security team is warning administrators to prepare for emergency security updates tomorrow to address two critical vulnerabilities, as information about the…
PHP2Shell and the Future of AI-Discovered Vulnerability Disclosure: Evidence, Verification, and Human Authority
arXiv:2610.36334v1 Announce Type: new Abstract: AI-assisted vulnerability discovery can produce technically plausible findings faster than maintainers can validate…
Tailscale Rushes Patches After Uncoordinated Disclosure of ‘Tailworm’ Flaws
Tailscale is preparing a patch for Tailscale SSH flaws whose details went public over the weekend, before any fixes had been released.