[Notice] PHP Critical Security Release Due 23:00 JST on 21 October (Two Flaws at CVSS v4.0 9.2) — Check Your Version and Upgrade Plan Now

The PHP security team has given advance notice of a security release that fixes two critical vulnerabilities. It is scheduled for Wednesday, 21 October 2026 at 14:00 UTC (23:00 in Japan), and both flaws are rated CVSS v4.0 9.2. If you run PHP yourself, check your PHP version and your upgrade procedure now.

First, the scope of this article. This is about the notice before the release. The official announcement says "full details, affected versions, and the fixed versions will be published with the release". So at this point no CVE IDs, no affected versions and no fixed version numbers have been published. This article does not guess them. Once the release is out, check the official announcement under "Pages we relied on".

What the official notice says (20 October 2026)

• ▸When it was posted: on the php.net front page at 20:32 UTC on 20 October 2026 (05:32 on 21 October in Japan)
• ▸Scheduled release: Wednesday, 21 October 2026 at 14:00 UTC (23:00 in Japan)
• ▸What it fixes: two critical vulnerabilities, both CVSS v4.0 9.2
• ▸The ask: "All PHP users are encouraged to prepare now so they can upgrade as soon as the release is available"
• ▸It may come earlier: the team reserves the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild
• ▸Details: full details, affected versions and fixed versions will be published with the release

What to do now

• ✓★Find out your PHP version. On a server, run `php -v` on the command line. The PHP your web server uses can be a different version from the command-line one, so also check the control panel or phpinfo() (our note). On shared hosting, look at the version selected in your provider's panel
• ✓Check that the branch is still supported. php.net's "Supported Versions" (checked 21 October 2026) lists 8.2, 8.3, 8.4 and 8.5. Security support ends on 31 December 2026 for 8.2, 31 December 2027 for 8.3, 31 December 2028 for 8.4 and 31 December 2029 for 8.5. 8.1 and earlier are not in that table
• ✓Know the current latest versions. The security release of 24 September 2026 produced 8.2.34, 8.3.35, 8.4.26 and 8.5.11 (php.net). The next version numbers have not been announced. Do not guess them
• ✓Decide who upgrades. The method differs depending on whether you manage the server yourself, your hosting company updates it, you install PHP from an OS package, you use an official Docker image, or you run something like WordPress on top (our note)
• ✓If you use hosting or a managed service, read your provider's notices. If you cannot upgrade yourself, you will be waiting for the provider; check their notice for when (our note)
• ✓Prepare for the upgrade. Have a backup, a test environment, a list of things to check afterwards, and a time slot after 23:00 JST on the 21st (our note)
• ✓Do not use PHP 8.6.0 RC builds in production. php.net's front page says of RC3 "Please DO NOT use this version in production"
• ✓Take the update from an official source: php.net's download page, your OS's official repository or the official Docker image. Stay away from files or emails claiming to be a "fix" or a "proof of concept" that circulate around the release (our note)

What to check once the release is out

• ▸Check the official announcement to see whether your version is affected. The php.net front-page announcement, the ChangeLog and the php/php-src security advisories on GitHub will carry the CVE IDs, affected versions and fixed versions (per the official notice)
• ▸Upgrade to the fixed version. Move to the version the official announcement gives for your branch (8.2 / 8.3 / 8.4 / 8.5)
• ▸See whether there is a workaround. In case you cannot upgrade at once, check the official announcement for one. This article gives none because none has been published
• ▸Check whether exploitation is reported. The team says it will release earlier if attacks are seen. If the published details mention exploitation, raise the priority of the upgrade

What I could not confirm

• ▸CVE IDs. As of 09:18 UTC on 21 October 2026 (18:18 in Japan) the two CVE IDs had not been published. I found nothing matching these two among the published advisories of php/php-src on GitHub (the latest published were from 24 September)
• ▸What the flaws are (the type, which feature). The official notice gives only the severity figure (CVSS v4.0 9.2)
• ▸Affected and fixed versions. They will be published with the release. I cannot tell whether all of 8.2 to 8.5 are affected or only some
• ▸How 8.1 and earlier are handled. They are not in the support table, so whether fixes will appear must be checked in the official announcement
• ▸Whether the flaws are being exploited. The team says it will release earlier if attacks are seen, but there is no statement at this point that attacks have been observed
• ▸The actual release time. It is scheduled for 23:00 JST on the 21st, but the team reserves the right to release earlier. By the time you read this it may already be out; check the php.net front page

Three lines to share

• ▸PHP plans a security release fixing two critical vulnerabilities (CVSS v4.0 9.2 each) at 23:00 JST on 21 October (it may come earlier). Details and fixed versions will be published with the release (php.net)
• ▸★Now: check your PHP version (php -v, control panel) and that it is a supported branch (8.2 to 8.5), and fix who upgrades, how, and your backup.
• ▸When it is out, read the php.net announcement and the GitHub advisories to see if your version is affected, and upgrade from an official source. Stay away from circulating "fixes" and "proof-of-concept" code

Pages we relied on