The PHP security team will ship a security release on 21st October 2026, fixing two critical vulnerabilities, each rated 9.2 under CVSS v4.0. The team urged every PHP user to be ready to upgrade the moment it lands.
What’s The News?
- The PHP security team scheduled the release for 14:00 UTC and may ship earlier if flaw details leak or attacks begin.
- PHP has not named the affected versions yet, so anyone running PHP should treat their servers as potentially exposed.
- PHP’s notice addresses all users, from solo developers and startups to hosting companies and large enterprises.
- The UK’s NCSC told organizations to check every PHP version they run and consider taking unpatchable systems offline.
Two 9.2-rated flaws, one release window
The PHP security team’s advance notice, posted on 20th October, 2026, set the release for 14:00 UTC. Its message to users was blunt: “All PHP users are encouraged to prepare now so they can upgrade as soon as the release is available.”
That audience is enormous. PHP runs on web servers to build dynamic pages, talk to databases and handle backend logic. It also ships inside a range of other products. A personal blog on a cheap host, a startup’s customer portal and an enterprise’s internal tools all wait on the same fix.
PHP hasn’t said which versions carry the bugs. The team will publish full details, affected versions and fixed versions only with the release itself. Until then, the safe reading for any business or individual is that every PHP install could be in scope.
The timing isn’t fully locked either. PHP said it may release earlier if details of either vulnerability become public, or if evidence of active exploitation appears. That clause is a hedge against the kind of uncoordinated zero-day disclosures that shrink a patch window to nothing.
The PHP security team is giving advance notice: Upcoming security release Wed, Oct 21st 2026, 14:00UTC, two critical vulnerabilities, both rated CVSSv4 9.2. PHP users are encouraged to prepare to update. Earlier release if details become public or active exploit evidence.
— The PHP Foundation (@ThePHPF) October 20, 2026
What PHP users should do before the patch lands?
Preparation is the only move available right now, and most of it is inventory. Anyone running PHP can start with these steps:
- List every server, container and application running PHP, with internet-facing systems first.
- Note which branch each one runs, so the right fixed build can go on quickly.
- Book a maintenance window, or warn customers that a short one is coming.
- Ask managed hosting and SaaS providers when they plan to roll out the fixed builds.
- Check with vendors whose appliances or services bundle PHP.
The branch check matters more than usual. PHP’s last security releases, published on 24th September, 2026, were 8.2.34, 8.3.35, 8.4.26 and 8.5.11. Any server below those builds was already missing earlier security fixes, and it faces a bigger jump once the new versions ship.
Bundled copies are the ones most easily missed. A team can patch PHP on its own servers whenever it chooses. A copy built into a vendor appliance stays exposed until that vendor ships its own update. Watching exposed systems for unusual activity helps reduce risk during that gap, though it won’t close the flaws.
Britain’s National Cyber Security Centre (NCSC) has also weighed in. Its alert tells UK organizations to prepare for immediate updating and to identify systems running any version of PHP. It also tells them to monitor internet-facing PHP systems for malicious activity and to keep checking third-party vendors for updates.
Why It Matters?
The sharpest line covers systems that can’t be fixed fast. Where immediate remediation isn’t feasible, the agency said, organizations “should consider taking the system offline until it can be fully mitigated.” That advice is aimed at UK organizations, but the reasoning applies to any PHP deployment facing the internet.
Several questions stay open until the advisories appear. Can an attacker reach either flaw remotely? Do the fixes cover the PHP 8.6 release candidates, with RC4 due the day after this release? How long will appliance makers need?
The answers, along with fixed version numbers and affected ranges, arrive with the release at 14:00 UTC unless PHP pulls it forward. From that point every PHP install should move to its branch’s fixed build. Any internet-facing system that can’t be updated then faces the offline question the NCSC raised.
