PHP Critical Security Release on October 21: What Admins Should Prepare Now

TL;DR - The PHP security team will release fixes for two critical vulnerabilities, each rated CVSS v4.0 9.2, on Wednesday, October 21, 2026 at 14:00 UTC (7:00 AM PT / 10:00 AM ET). - PHP says it may ship earlier if details go public or exploitation appears. Researchers at watchTowr say information has already leaked. - Affected versions, fixed versions and technical details have not been published yet; they arrive with the release. - watchTowr reports both are remote code execution flaws and has seen no exploitation in the wild so far. - Use today to inventory every PHP runtime and pre-approve a change window. Patching speed tomorrow depends on that list.

Developing story. This page will be updated with affected branches, fixed versions and NVD data once the PHP release is published.

What happened#

On October 20, 2026, the PHP project posted an advance notice on php.net and its ANNOUNCE mailing list. The notice confirms three things:

• A security release is scheduled for October 21, 2026 at 14:00 UTC.
• It fixes two critical vulnerabilities, both scored 9.2 under CVSS v4.0.
• Full details, affected versions and fixed versions will be published together with the release.

PHP also reserved the right to release early if either vulnerability becomes public or is seen exploited. Treat 14:00 UTC as the latest likely time, not a fixed one.

What researchers are reporting#

BleepingComputer reports that watchTowr researchers say:

Two points are worth keeping straight. First, PHP’s own score is 9.2 (CVSS v4.0); the 10.0 figure comes from researchers and an earlier forum post, and scores under CVSS v3.1 and v4.0 are not directly comparable. Second, PHP 6 was never released as a stable branch, so a “PHP 5 to 8” range in practice points at the 5.x, 7.x and 8.x lines. Confirm against the official advisory when it lands.

Are you affected?#

Assume yes until the release says otherwise. PHP runs far more places than the web servers on your asset list:

• Web servers running mod_php or PHP-FPM behind Nginx or Apache
• Container images built on official or third-party PHP base images
• CMS and e-commerce platforms (WordPress, Drupal, Magento and similar) and their hosting panels
• Shared and managed hosting, where the provider controls the PHP build
• Internal tools, CI runners and scripts using the PHP CLI
• Appliances and vendor products that bundle PHP for their web interface

The most recent upstream security releases, on September 24, 2026, covered PHP 8.2, 8.3, 8.4 and 8.5. Branches older than that did not receive those fixes, which strongly suggests end-of-life versions will not get an upstream patch this time either. Plan for those now.

How to prepare today#

1. Build the inventory. List every host, container and service that runs PHP, its version and its owner. Use the commands below and your asset or scanning tools.
2. Separate supported from end-of-life branches. Supported branches (8.2 to 8.5 as of the September releases) should get fixes tomorrow. Anything older needs an isolation or upgrade plan.
3. Know your patch source. Distribution packages (Debian, Ubuntu, RHEL and derivatives) usually backport fixes into their own version numbers, so watch your distro’s security advisories rather than matching upstream version strings. Containers need a rebuilt image; managed hosting needs the provider.
4. Pre-approve a change window for October 21 and confirm who can deploy. The goal is to patch internet-facing PHP within hours of the release.
5. Stage the rollout. Make sure a test environment and rollback path exist, so testing a new point release does not become the bottleneck.
6. Apply general exposure reduction now. Keep PHP-FPM listening only on a local socket or loopback, put admin interfaces behind access controls, and make sure a WAF or reverse proxy is in front of public PHP apps. These are good hygiene, not a known mitigation for these specific bugs, which have not been described.
7. Subscribe to the official channels: the php.net news feed and the PHP ANNOUNCE mailing list.

Commands to find PHP

# Version of the CLI and of PHP-FPM
php -v
php-fpm -v 2>/dev/null || ls /usr/sbin/php-fpm* 2>/dev/null

# Installed PHP packages (Debian/Ubuntu, then RHEL family)
dpkg -l | grep -E '^ii\s+php' 2>/dev/null
rpm -qa | grep -i '^php' 2>/dev/null

# Container images that look like PHP
docker images | grep -i php

# Confirm PHP-FPM is not listening on a network interface (port 9000 is the common default)
ss -ltnp | grep -E ':9000\b'

Vulnerability scanners can speed up the inventory across many hosts. If you need one, Check Tenable Nessus pricing. This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.

What to do when the release ships#

• Read the official advisory first and note the exact affected and fixed versions per branch.
• Patch internet-facing PHP applications first, then internal ones, then CLI and tooling.
• Rebuild and redeploy container images; restart PHP-FPM so the new binary is loaded.
• Check your distribution’s advisory for backported package versions.
• Review web and application logs from the leak window onward for unusual requests and new PHP-spawned processes once indicators are published.
• Re-scan to confirm no unpatched PHP remains.

A related issue for PHP apps this week#

PHP applications that make outbound HTTPS calls through Composer’s ca-bundle package are also affected by this week’s eMudhra intermediate CA compromise. As of October 20, the Composer ca-bundle fix was still pending, so plan to update it in the same maintenance window if it ships in time.

Related reading: Why “patch everything” is bad advice, What is Patch Tuesday? and our CVE explainers.

This advisory is informational. Confirm affected versions and fixes against the official PHP release and your vendor’s guidance.

Sources

• PHP Group, Upcoming Critical PHP Security Release (October 20, 2026)
• BleepingComputer, PHP warns admins of two critical flaws, emergency patches coming tomorrow (October 20, 2026)