# Upcoming Critical PHP Security Release

- Thread: https://externals.io/message/132883
- Original archive: https://news-web.php.net/php.internals/132883
- Started by Jakub Zelenka on 2026-10-20T19:32:40+00:00
- Messages: 1
- Reply by email to internals@lists.php.net
- More for agents: search with https://externals.io/search.md?q={query} · RFCs at https://externals.io/rfc.md · JSON API at https://externals.io/api · documentation at https://externals.io/llms.txt

---

## #132883 — Jakub Zelenka — 2026-10-20T19:32:40+00:00

URL: https://externals.io/message/132883#132883

We want to inform you of an upcoming PHP security release that addresses
two critical vulnerabilities (both rated CVSS v4.0 9.2, Critical).

The release is scheduled for Wednesday, 21 October 2026 at 14:00 UTC. We
encourage all PHP users to prepare now so you can update as soon as it is
available.

We reserve the right to release earlier if details of either vulnerability
become public, or if we see evidence of active exploitation in the wild.

The PHP security team