The PHP security team issued an advance alert regarding an upcoming critical security release scheduled for October 21, 2026, at 14:00 UTC. The forthcoming update addresses two critical vulnerabilities, both carrying a severe CVSS v4.0 base score of 9.2. All PHP users and administrators have been advised to prepare their systems in advance to facilitate immediate upgrading once the patches go live. The release team noted that updates could be deployed earlier if details of either vulnerability leak publicly or if active in-the-wild exploitation is detected. Comprehensive details regarding the affected versions and specific bug fixes will be published simultaneously with the official software release.

Full report : PHP Security Team Issues Advance Notice for Critical Security Release Addressing High-Severity Vulnerabilities.