PHP Warns of Two Critical Flaws Rated 9.2, Patch Lands October 21
Upcoming Critical PHP Security Release
The PHP security team has issued advance notice of a security release scheduled for Wednesday, 21 October 2026 at 14:00 UTC, addressing two critical vulnerabilities both rated CVSS v4.0 9.2. Users are urged to prepare upgrades in advance; the team reserves the right to ship earlier if details leak or active exploitation appears. Affected versions and fixes will be published with the release.
We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild.
- devttyeu
@dang if the speculations circulating around are anything to go by this is apocalyptic and deserves to be amplified such that the right people see this before it’s too late.
CERT-EU even suggests isolating any systems that may be exposed and can’t be patched quickly.
Speculation is that the affected subsystem runs before any application code and affects all default installs.
- Numerlor
Well this is about as bad as it gets, so I guess the internet will get a bit of test and old forums will turn into a botnet
- samueloph
Deciding to announce it like this is wild, it's an invitation for everyone to put their agents to work in order to find out what the vulnerability is and exploit it, while nobody is allowed to patch it until tomorrow.