Topic: PHP critical updates Wed Oct 21st 2026, 14:00 UTC

[Jan-E]

https://thehackernews.com/2026/10/php2shell-two-unpatched-critical-php.html
PHP will ship an out-of-cycle security release at 14:00 UTC today, October 21, for two critical vulnerabilities that its security team has rated 9.2 on the CVSS v4.0 scale but has not described.

See https://www.php.net/archive/2026.php#2026-10-20-1 as well.
Upcoming Critical PHP Security Release
The PHP security team would like to give advance notice of an upcoming security release.

It is scheduled for Wednesday, 21 October 2026 at 14:00 UTC.

It addresses two critical vulnerabilities, both rated CVSS v4.0 9.2.

All PHP users are encouraged to prepare now so they can upgrade as soon as the release is available.

We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild.

Full details, affected versions, and the fixed versions will be published with the release.

Thank you for helping us keep PHP secure.

[Jan-E]

https://github.com/php/php-src/tags

[Jan-E]

https://github.com/remicollet/php-src-security/branches
Backports for PHP 7.4, 8.0 & 8.1

[Materix]