Two Critical Vulnerabilities in PHP to be Disclosed

The PHP security team has announced an upcoming security release scheduled for Wednesday, October 21st 2026 at 14:00 UTC. The release will address two critical vulnerabilities, both rated CVSSv4 9.2. PHP users are encouraged to prepare to update, and the team notes they may release earlier if details become public or if there is evidence of active exploitation. The vulnerabilities presumably affect PHP since version 5.