php.netadvisoryUpcoming Critical PHP Security Release
The php.net 2026 news archive opens with the PHP security team's advance notice of a release scheduled for 21 October 2026 at 14:00 UTC. It fixes two critical vulnerabilities, both rated CVSS v4.0 9.2, and may ship earlier if details leak or exploitation appears. Details and fixed versions come with the release. The archive also lists 2026 security releases (8.2.34, 8.3.35, 8.4.26, 8.5.11), PHP 8.6 RC3 and conference announcements.
TL;DR Announces a PHP security release on 21 October 2026 fixing two CVSS 9.2 vulnerabilities, within the 2026 PHP news archive.
Organisations named here
- PHP 8.2.34
- PHP 8.3.35
- PHP 8.5.11
Technologies named here
- PHP 8.4
- PHP 8.5
- PHP 8.3
- PHP 8.2
- PHP
- CVSS
- PHP 8.4.26
Related in AppSec
github.comadvisoryFlowise MCP Security Bypass Enables RCE
huntress.comwriteupInside an Oracle Database SQL Injection Attack | Huntress
github.comrepoOASIS
blog.trailofbits.comwriteup