PSA: Critical PHP Vulnerability Disclosure scheduled for tomorrow CVSS Rating 9.2

Off Topic
1

We want to inform you of an upcoming PHP security release that addresses two critical vulnerabilities (both rated CVSS v4.0 9.2, Critical).

The release is scheduled for Wednesday, 21 October 2026 at 14:00 UTC. We encourage all PHP users to prepare now so you can update as soon as it is available.

We reserve the right to release earlier if details of either vulnerability become public, or if we see evidence of active exploitation in the wild.

The PHP security team

It’s an RCE (Remote Code Execution) which means it will be IMMEDIATELY exploitable once released

2

It’s a bad one folks!

There were a number of other bad security incidents today.

It’s already out there :smiling_face_with_horns:

3

Stopgap for those with Cloudflare in front of their apps. This doesn’t replace updating PHP. But will buy you a little time.

IMG_0359
IMG_03591320×1312 276 KB

4

Patch will be Released at 10AM (EST) / 11 CT / 14:00 UTC: Here

5

Looks like the Linux packages dropped early. Go update!

6

and… the php.net site is down cause… ofcourse it is oh boy