The PHP security team announces a critical security update scheduled for Wednesday, 21 October 2026 at 14:00 UTC. Outlets report the release is expected to address two vulnerabilities rated 9.2 as “Critical” using CVSS v4.0. The notice signals that specific details—such as affected PHP versions and descriptions of the vulnerabilities—will be published when the patched release becomes available.
In the meantime, sources advise administrators and PHP users to prepare to upgrade as soon as the update is released. Because the pre-release announcement does not yet specify which versions or components are impacted, some coverage recommends treating all PHP installations as potentially affected, pending the full advisory and version mapping that the PHP team plans to publish at release time.
