news-web.php.netadvisoryUpcoming Critical PHP Security Release
The PHP security team announces an upcoming PHP security release that fixes two critical vulnerabilities, both rated CVSS v4.0 9.2. The release is scheduled for Wednesday, 21 October 2026 at 14:00 UTC. The team says it may release earlier if details become public or exploitation in the wild is seen. The notice gives no CVE IDs, affected versions or technical details.
TL;DR PHP security team pre-announces a 21 October 2026 release fixing two CVSS 9.2 critical vulnerabilities.
Organisations named here
- PHP security team
Technologies named here
- PHP
- CVSS
Related in AppSec
github.comadvisoryFlowise MCP Security Bypass Enables RCE
huntress.comwriteupInside an Oracle Database SQL Injection Attack | Huntress
github.comrepoOASIS
blog.trailofbits.comwriteup