A critical PHP security release is coming today, so get ready to update!
The PHP security team has announced an urgent security release for Wednesday, 21 October 2026 at 14:00 UTC. The release fixes two vulnerabilities, each rated 9.2 (Critical) under CVSS v4.0.
The notice doesn’t yet describe the vulnerabilities or say which PHP versions they affect. The project will publish those details, along with the patched version numbers, when the release goes out. Until then, administrators should assume every PHP installation they run could be affected.
The team says it may release earlier than planned if details of either flaw become public or if attackers are found exploiting them. Anyone responsible for PHP servers is urged to “prepare now” so updates can be applied right away.
What to do before the release
- Make a list of where you run PHP, including web servers, containers, CI images and dev machines, and note each version.
- Know who updates it. On managed or shared hosting, your provider applies PHP updates, so ask when they plan to deploy this one. On your own servers, plan a maintenance window shortly after 14:00 UTC.
- Check for unsupported versions. Security fixes normally go only to supported branches (currently PHP 8.2 through 8.5). Sites on older versions may need a branch upgrade.
- For WordPress sites, find the PHP version under Tools → Site Health → Info → Server.
