PHP warns of two critical vulnerabilities rated 9.2 ahead of emergency release
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 out
The PHP security team has issued advance notice of a security release on 21 October 2026 at 14:00 UTC, addressing two critical vulnerabilities both rated CVSS v4.0 9.2. All PHP users are urged to prepare to upgrade immediately. The team says it may release earlier if details leak or active exploitation appears. The same day, PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 shipped.
We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild.