Today's PHP Security Release, and How We're Strengthening PHP Security

What it is

Simon Willison's 21 October 2026 link post quotes the PHP Foundation and Wiz Research on a security release across the entire PHP 8.x line. It fixes two remote code execution flaws. The post says exploits have been circulating since the night of 20 October 2026.

How the disclosure went off schedule

The release was planned for 22 October 2026 at 14:00 UTC. The CVE IDs began circulating around 15:00 UTC on 20 October, with a wrong release time and a wrong CVSS score. The PHP project published its pre-announcement at 19:30 UTC and moved the release to 21 October at 14:00 UTC.

Calif, one of the reporting firms, then published a proof-of-concept video around 20:00 UTC and deleted it. Copies spread, and the PHP Foundation says the video sped up development of other proofs of concept. No technical details leaked in the original CVE leak. The video added a few limited details.

Affected

All of the PHP 8.x line. The post confirms unauthenticated RCE against Drupal and WordPress, per Wiz Research's August 2026 testing.

What to do

Upgrade PHP. The post calls this vital for anything running on PHP, and public proofs of concept now exist. It gives no fixed version numbers, CVE IDs, workarounds or detection guidance, so take those from the PHP Foundation announcement.

Caveats

• Wiz Research reported the bugs to PHP on 24 August 2026. PHP acknowledged them on 21 September 2026, and patches shipped on 21 October 2026. The flaws had been exploitable on common CMS targets since August.
• Wiz says it found the first bug on 19 August 2026 using Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol.
• The post does not say who leaked the CVE IDs.