PHP Preannounces Two Critical Flaws: Prepare Websites for the October 21 Release

An urgent advance notice for PHP-powered websites

The PHP security team announced on October 20, 2026 that an upcoming release addresses two critical vulnerabilities, both rated CVSS v4.0 9.2. It is scheduled for October 21 at 14:00 UTC, or 21:00 in Vietnam. Owners of PHP applications and WordPress sites should identify an update owner before that window.

At this morning’s source check, the PHP notice had not published technical details, affected versions or fixed versions. This is a dated advance-notice story, not a claim that the fixes are already available. PHP may release earlier if details become public or evidence of exploitation appears.

What is confirmed and what remains uncertain

The 9.2 rating warrants priority, but does not identify the attack mechanism, the most exposed configuration or a compromised customer site. The possibility of an earlier release if exploitation appears is not confirmation of ongoing attacks.

CERT-EU advisory 2026-018 also references external leaks for some CVE and version claims. This report treats the PHP team’s notice as authoritative for confirmed affected and fixed versions: those details remain pending. Reconcile the full advisory when it arrives.

Older downloads and PHP 8.6.0 RC3, announced October 8 for testing, are not evidence that this scheduled fix has shipped. PHP explicitly warns against production use of that release candidate.

Prepare the runtime actually serving the website

Friday Works recommends mapping each website to its serving PHP runtime and owner: hosting provider, virtual machine, container or managed platform. Command-line, web and scheduled-job runtimes can differ; a terminal version alone may miss the one processing visitor traffic.

Ask hosting providers for update timing and post-change version evidence. Self-managed teams should prepare a restorable backup, current configuration and representative staging. Avoid unverified “PHP patch” plugins or architectural changes made solely in response to urgency.

The genuine phpinfo Core capture comes from an isolated local PHP 8.5.7 demonstration on October 21. It shows version inspection, not the forthcoming fix. Do not expose production phpinfo pages, which can reveal configuration and environment details.

What to verify once the fixes are published

Once the advisory and official packages appear, compare the running branch with the affected/fixed list and use the provider’s supported upgrade route. Friday Works suggests checking sign-in, forms, a non-chargeable test order and PHP background jobs in staging before broader rollout.

Confirm the serving processes actually run the remediated package and review application errors. Distribution backports should be assessed against that distributor’s advisory rather than upstream version numbers alone. Record timing and acceptance results for each site.

This morning’s report cannot responsibly name a fixed version or update command before publication. Follow the linked PHP notice; 21:00 is the planned release time, not an automatic patching deadline achieved by every website.