PHP warns of two critical 9.2-rated vulnerabilities, patch lands October 21
Upcoming Critical PHP Security Release
The PHP security team announced an upcoming release fixing two critical vulnerabilities, both rated CVSS v4.0 9.2. The patch is scheduled for Wednesday, 21 October 2026 at 14:00 UTC, and users are urged to prepare to update immediately. The team reserves the right to ship earlier if details leak or active exploitation is detected in the wild, so admins should watch closely.
We reserve the right to release earlier if details of either vulnerability become public, or if we see evidence of active exploitation in the wild.
- TekMol
Many here call for an earlier release of the patch.
But it is not clear if releasing the fix early would make the damage smaller or larger.
Having the patch probably makes creating an exploit easier. So the number of attacks would increase.
There is no way to coordinate the whole world on an earlier time. I would guess the number of people that have to patch their instances is in the hundreds of thousands.
Everybody who actively watches the topic already has the option to shut down their instances.
So ringing the bell and getting as many people as possible to shut down their webservers now and patching at 14:00 might be the best in terms of damage minimisation.
- janmo
Cloudflare: "We are seeing early attacks emerging and are updating mitigations as new vectors show up."
https://x.com/dok2001/status/2112811965735202970
When will they finally release the patch?!
- nr378
Given that this affects every PHP version from the past decade, and that the exploit instructions are circulating at the top of twitter, and that there's no fix available yet, it doesn't seem outrageous to assume every major PHP website is already compromised?
The upgrade instructions here should include torching your hosts and starting again.
- anthonyeden
From what I can tell, Cloudflare has mitigated this via their WAF [0] (free and paid).
The Alpine GitLab[1] indicates the PHP versions to be released 21-10-2026 14:00:00 UTC are:
8.5.12
8.4.27
8.3.36
8.2.35
[0] https://developers.cloudflare.com/waf/change-log/changelog/
[1] https://gitlab.alpinelinux.org/groups/alpine/-/work_items?sh...
- bwoebi
For everyone wondering why the patch is not out yet:
There are a handful people responsible for doing a release. They are still asleep.
To be honest, I am also shocked, that the exploit was published that quickly, after the leaked video (which was the reason, why the announcement happened in the first place, at that specific time). We expected a bit more time, even with LLMs...
- reddalo
The Release Candidate for the patched version is out! I hope a stable release will soon follow along. They're already attacking websites in the wild.
- redox99
The exploit is already out. Yeah this looks like it's going to go on history as the worst vulnerability ever. And now with LLMs you'll likely see tens of thousands of agents hacking any php website out there within hours.
- petervandijck
I just took down my 10 or so sites until the fix is out. A few hours of downtime versus worrying something got injected in my cache or db
- dawnerd
I tried it on a personal site, was able to dump the entire database. Immediately shut all my sites down. This is bad.
- Gigachad
The demo video has been going around Twitter today and apparently the proof of concept is privately being shared around too. The video shows pasting something in the URL and then gaining a shell on the server. It looks completely catastrophic.
I think the best course of action is to just shut your server down before the patch goes live and then bring it back after you have patched.