# PHP schedules emergency patches for two critical CVSS 9.2 flaws on October 21 The PHP security team has warned of two critical vulnerabilities, both rated 9.2 under CVSS v4.0, with fixes planned for 14:00 UTC on October 21. Affected versions and technical details are intentionally withheld until release. PHP operators have advance notice to schedule urgent updates, but no verified affected-version list, exploit path or workaround yet. Check official release notes before acting on speculative vulnerability claims. - Status: Active - Published: 2026-10-21T19:16:26+13:00 - Updated: 2026-10-21T19:16:26+13:00 - Categories: Web Development, PHP - Tags: PHP-FPM, security - Canonical HTML: https://beyondthe.news/dossiers/php-two-critical-security-patches-october-21-2026-advance-warning ## What changed On October 20, 2026, the PHP security team issued an advance notice for a coordinated emergency release addressing two critical vulnerabilities, each rated CVSS v4.0 9.2. The release is scheduled for Wednesday, October 21 at 14:00 UTC (03:00 NZDT on October 22). The team encourages all PHP users to prepare for prompt upgrades and reserves the right to release earlier if vulnerability details become public or exploitation is observed. As of the notice, the affected versions, fixed version numbers, CVEs, root causes and exploitability conditions have not been published. Independent specialist reporting confirms the advisory but does not establish unannounced exploit mechanics. ## Why it matters PHP powers web applications, CMS installations and server-side APIs. A two-flaw critical advisory with an imminent release is a practical patch-planning event: hosting operators, maintainers and agencies need time to arrange testing, package availability, maintenance windows and rollbacks. It would be irresponsible to claim every PHP version is vulnerable or prescribe speculative workarounds before official details appear. ## Confirmed schedule and severity PHP.net's October 20 advisory and the security team's php.internals notice say two vulnerabilities will be fixed, each CVSS v4.0 9.2 Critical. The intended release time is 14:00 UTC on October 21, with earlier release possible if circumstances change. The advisory intentionally omits affected versions and technical detail. ## Prepare an urgent but controlled update Inventory PHP versions across production, staging, cron/CLI workers and containers. Confirm how each environment obtains upstream or distribution packages, ensure backups and rollback are available, and arrange rapid smoke tests for key applications. Follow official PHP release notes and vendor advisories for exact fixed branches; distribution package versions may carry backported patches. ## Do not infer an exploit from an advance notice Some social posts assert specific request patterns or broad impact, but the security team has not publicly confirmed them. Do not assume a generic WAF rule mitigates the flaws or that every historical PHP branch receives a fix. Wait for official CVEs, affected versions and patch guidance; escalate monitoring and operational readiness without circulating unverified technical claims. ## Next evidence gate At the release, verify PHP.net release posts, change logs and security advisories for fixed versions, exposure conditions and any configuration-specific mitigations. Update this dossier only with those confirmed details. Operators of unsupported PHP versions should coordinate with hosting/distribution maintainers about support and migration. ## Key details - Official PHP security-team advisory dated October 20, 2026. - Two vulnerabilities, each CVSS v4.0 9.2 Critical. - Planned patch release: October 21, 2026 at 14:00 UTC; earlier release possible. - Affected versions, fixed builds, CVEs and technical exploit details not yet published as of advance notice. - Security team asks all PHP users to prepare for timely updates. ## Builder takeaways - Identify every PHP runtime, including CLI workers and containers, and prepare for a controlled emergency upgrade. - Wait for the official fixed-version matrix; do not rely on unverified exploit rumours or WAF workarounds. - Coordinate with shared hosts and Linux package maintainers for backported fixes where relevant. - Retest authentication, uploads, sessions and key workflows after applying the verified security releases. ## What to watch - Official PHP.net security releases at or before October 21 14:00 UTC. - Published CVEs, affected versions and any verified exploit/mitigation details. - Downstream distro and managed-hosting patch availability. ## Uncertainties - Specific vulnerable branches and exploitation prerequisites remain undisclosed. - No confirmed exploitation or precise workaround is stated in the official advisory. - The release schedule may change if details become public earlier. ## Sources - [Upcoming Critical PHP Security Release](https://www.php.net/archive/2026.php#2026-10-20-1) — PHP Security Team · primary advisory · 2026-10-20T00:00:00+13:00. Official severity, schedule and deliberate non-disclosure of affected versions. - [PHP warns admins of two critical flaws, emergency patches coming tomorrow](https://www.bleepingcomputer.com/news/security/php-warns-admins-of-two-critical-flaws-emergency-patches-coming-tomorrow/) — BleepingComputer · independent specialist reporting · 2026-10-20T00:00:00+13:00. Independent confirmation and context; no unverified exploit details adopted.