Last updated: October 21, 2026, 8:06 a.m. New York time. This is a developing story. We'll update this article as the PHP team publishes details.

The PHP security team just gave advance notice of a critical security release. It ships today, Wednesday, October 21, 2026, at 14:00 UTC (10:00 a.m. New York time). It fixes two vulnerabilities, and both are rated 9.2 on CVSS v4.0.

The PHP team doesn't usually announce a release ahead of time so a heads-up a day before, with two scores this high, means you should be ready to update as soon as possible.

What We Know

Here is the full notice from php.net:

The PHP security team would like to give advance notice of an upcoming security release.

It is scheduled for Wednesday, 21 October 2026 at 14:00 UTC.

It addresses two critical vulnerabilities, both rated CVSS v4.0 9.2.

All PHP users are encouraged to prepare now so they can upgrade as soon as the release is available.

We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild.

Full details, affected versions, and the fixed versions will be published with the release.

So far that gives us:

  • When: October 21, 2026, at 14:00 UTC, or earlier if the details leak or someone starts exploiting either bug
  • How many: two vulnerabilities
  • Severity: both critical, CVSS v4.0 9.2
  • Exploitation: the notice doesn't report any. The team says it will release early if that changes.

What CVSS v4.0 9.2 Means

CVSS is the Common Vulnerability Scoring System, a standard way to rate how serious a security bug is. FIRST, a global group of security response teams, maintains it. Version 4.0 is the current edition, published in November 2023.

Every bug gets a score from 0 to 10, and the score falls into a severity band:

  • Critical: 9.0 to 10.0
  • High: 7.0 to 8.9
  • Medium: 4.0 to 6.9
  • Low: 0.1 to 3.9

A 9.2 puts both bugs in the critical band. The score comes from questions like whether an attacker can reach the bug over the network, whether they need to log in, and how much damage they can do to the system. We won't know which of those drove these scores until the advisories are public. For comparison, the worst bug in 8.5.11, the SOAP server crash, was rated high.

What We Don't Know Yet

Here is a list of things we don't know:

  • Which PHP versions are affected
  • The version numbers that fix it
  • Which part of PHP each bug is in (the engine, an extension, or a SAPI like FPM)
  • CVE IDs and GitHub security advisories
  • Whether either bug needs a specific configuration to reach

What You Should Do

Get ready so the upgrade takes minutes instead of a day:

  • List your PHP versions. Run php -v on every server, container, and CI image, and note which branch each one is on. Remember the CLI and FPM can be different builds on the same box.
  • Know where your PHP comes from. Most people get PHP from a distribution package, a PPA, Homebrew, or an official Docker image rather than building it. Those channels publish their builds after php.net does, so find out how yours announces updates.
  • Check your base images. If you build on php:8.x-fpm or similar, plan to rebuild and redeploy once the new tags are up, not just restart.
  • Book the time. Plan a maintenance window for after 14:00 UTC, and make sure someone who can deploy is around.
  • Have tests ready. Security releases are patch releases with no new features, but they can still change behavior. Last month's 8.5.11 stopped sending credentials across cross-origin redirects, which could look like a new 401 after the upgrade.

Timeline

  • October 20, 2026: The PHP security team posts advance notice on php.net.
  • October 21, 2026, 14:00 UTC: Scheduled release.

Read More