What changed
On October 20, 2026, the PHP security team issued an advance notice for a coordinated emergency release addressing two critical vulnerabilities, each rated CVSS v4.0 9.2. The release is scheduled for Wednesday, October 21 at 14:00 UTC (03:00 NZDT on October 22). The team encourages all PHP users to prepare for prompt upgrades and reserves the right to release earlier if vulnerability details become public or exploitation is observed. As of the notice, the affected versions, fixed version numbers, CVEs, root causes and exploitability conditions have not been published. Independent specialist reporting confirms the advisory but does not establish unannounced exploit mechanics.
Why it matters
PHP powers web applications, CMS installations and server-side APIs. A two-flaw critical advisory with an imminent release is a practical patch-planning event: hosting operators, maintainers and agencies need time to arrange testing, package availability, maintenance windows and rollbacks. It would be irresponsible to claim every PHP version is vulnerable or prescribe speculative workarounds before official details appear.
Confirmed schedule and severity
PHP.net's October 20 advisory and the security team's php.internals notice say two vulnerabilities will be fixed, each CVSS v4.0 9.2 Critical. The intended release time is 14:00 UTC on October 21, with earlier release possible if circumstances change. The advisory intentionally omits affected versions and technical detail.
Prepare an urgent but controlled update
Inventory PHP versions across production, staging, cron/CLI workers and containers. Confirm how each environment obtains upstream or distribution packages, ensure backups and rollback are available, and arrange rapid smoke tests for key applications. Follow official PHP release notes and vendor advisories for exact fixed branches; distribution package versions may carry backported patches.
Do not infer an exploit from an advance notice
Some social posts assert specific request patterns or broad impact, but the security team has not publicly confirmed them. Do not assume a generic WAF rule mitigates the flaws or that every historical PHP branch receives a fix. Wait for official CVEs, affected versions and patch guidance; escalate monitoring and operational readiness without circulating unverified technical claims.
Next evidence gate
At the release, verify PHP.net release posts, change logs and security advisories for fixed versions, exposure conditions and any configuration-specific mitigations. Update this dossier only with those confirmed details. Operators of unsupported PHP versions should coordinate with hosting/distribution maintainers about support and migration.