PHP schedules emergency security release for two critical vulnerabilities rated 9.2
The PHP security team has announced an emergency security release scheduled for October 21, 2026, at 14:00 UTC (10:00 AM Eastern), addressing two critical vulnerabilities, each rated CVSS 4.0 9.2.
Technical details, affected PHP versions, and patched releases have not yet been disclosed. The PHP team warned that patches could be released ahead of schedule if vulnerability details become public or evidence of active exploitation emerges.
Administrators are urged to prepare for immediate patching. Organizations running PHP-based applications, including WordPress, Drupal, and other web platforms, should identify their PHP installations and verify their update procedures. Managed hosting customers should confirm their provider's patching plans.
The PHP project expects to publish full vulnerability details and fixed version numbers alongside the security release.