PHP Will Ship Emergency Fixes for Two Critical Vulnerabilities Tonight

The PHP security team says it will ship an emergency security release on Wednesday, October 21, 2026, at 14:00 UTC, which is 10 PM Manila time, to fix two critical vulnerabilities. In an advance notice on php.net posted October 20, the team said both flaws are "rated CVSS v4.0 9.2" and urged "all PHP users" to "prepare now so they can upgrade as soon as the release is available."

PHP has not said which versions are affected, which releases will carry the fixes, or what the bugs are. Its notice says: "Full details, affected versions, and the fixed versions will be published with the release." The team also warned that it may move faster than planned: "We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild." PHP security team member Jakub Zelenka sent the same warning to the php.internals mailing list on October 20.

Other reports have attached CVE numbers and broader claims about affected versions to these flaws, but PHP itself has not confirmed any of them yet. This post will be updated with the versions and CVE details once PHP publishes the release.

For context, PHP's supported versions page lists four branches still receiving security fixes: 8.2, 8.3, 8.4 and 8.5. The most recent releases on those branches, per php.net, are 8.5.11, 8.4.26, 8.3.35 and 8.2.34. Older branches are end of life and get no official fixes.

Are you affected?

Until PHP publishes the affected versions, assume any server running PHP is in scope and get ready to patch tonight.

1. Find every PHP install. On each server, run php -v to see the command-line version. Web requests can use a different build, so also check what the web server runs: a temporary page calling phpinfo() shows it (delete that page right after), and php-fpm -v or a versioned binary such as php-fpm8.3 -v covers FPM pools.
2. Check containers and images. Note the PHP base image tags in your Dockerfiles and CI, since those will need a rebuild once fixed images are out.
3. Sort by branch. Anything on 8.2, 8.3, 8.4 or 8.5 should get an official fix. Anything older is end of life on php.net, so check whether your OS vendor or host backports security fixes, or plan an upgrade.
4. Book a patch window for tonight. The release is set for 14:00 UTC (10 PM Manila, 10 AM US Eastern). Packaged PHP from distributions and hosting panels may arrive later than the php.net source release, so watch your vendor's channels too.
5. Prioritize internet-facing apps. Put public sites, APIs and admin panels at the front of the queue.
6. Watch php.net. Follow the php.net homepage and the releases feed, and be ready earlier than planned, since PHP says it may release early.