unread
We want to inform you of an upcoming PHP security release that addresses
two critical vulnerabilities (both rated CVSS v4.0 9.2, Critical).
The release is scheduled for Wednesday, 21 October 2026 at 14:00 UTC. We
encourage all PHP users to prepare now so you can update as soon as it is
available.
We reserve the right to release earlier if details of either vulnerability
become public, or if we see evidence of active exploitation in the wild.
The PHP security team