PHP Patches Two Critical Flaws Today (CVSS 9.2): What to Update and What to Do Now

Updated October 21, 2026, 07:40 (Ecuador time). We will update this post when the PHP team publishes the fixed versions.

On Tuesday, October 20, 2026, the PHP security team posted on php.net an advance notice of a critical security release. It fixes two critical vulnerabilities, both rated 9.2 on CVSS v4.0, and is scheduled for today, Wednesday, October 21, at 14:00 UTC (09:00 in Ecuador). The notice asks all PHP users to get ready now so they can upgrade as soon as it's available.

It's no reason to panic, but it is a reason to get organized today. Here's what we know, what we don't know yet, and what to do.

What happened and who is affected

PHP powers content management systems like WordPress, Drupal and Moodle, frameworks like Laravel and Symfony, and a huge number of custom systems: invoicing, intranets, online stores, customer portals. If your website or system runs on a server with PHP, this notice applies to you.

What the PHP team has not published yet: which exact versions are affected, where in the language the flaws are, and their CVE identifiers. According to the notice, "full details, affected versions, and the fixed versions will be published with the release." It also warns that the release may come earlier if details of either flaw become public or if there's evidence they're already being exploited.

Versions and patch schedule

• When: Wednesday, October 21, 2026, at 14:00 UTC (09:00 in Ecuador). It may come earlier.
• Which versions will ship: not confirmed yet; they'll be announced with the release.
• Branches supported today, per the official supported versions table:
  • PHP 8.5: active support (latest release before the patch: 8.5.11).
  • PHP 8.4: active support until 12/31/2026 (latest: 8.4.26).
  • PHP 8.3: security fixes only until 12/31/2027 (latest: 8.3.35).
  • PHP 8.2: security fixes only until 12/31/2026 (latest: 8.2.34).
  • PHP 8.1 and older: end of life. No official patches.

If you install PHP from your distribution's packages (Debian, Ubuntu, Red Hat and the like), a Docker image or managed hosting, the update reaches you through that channel and may take a few more hours. The version number may also differ from php.net's, because many distributions apply the fix on top of their own version. In that case, follow your distribution's or provider's security advisory.

What happens if you don't update

The type of flaw isn't public yet, so we won't guess. What we do know is that a 9.2 score falls within the critical range (9.0 to 10.0) of FIRST's CVSS v4.0 scale, the highest severity level.

Timing is what matters: when the patch ships, what was fixed becomes public too. From that moment anyone can compare the code before and after and look for servers that are still unpatched. With critical flaws, that window is usually short. Depending on the flaw, an unpatched server may be exposed to data theft, to someone running their own code, or to outages. Once the PHP team publishes the details, we'll explain the real impact of these two here.

What to do now

1. Take inventory. List every server, site or container that uses PHP and its version. From the console, php -v. Note: the console version may not be the one your website uses (PHP-FPM or the Apache module), so also confirm it from your hosting panel or with a temporary, protected phpinfo() page.
2. Back up your code and database before touching anything.
3. Get the update ready: decide who applies it, in which window, and how you roll back if something fails. If you have a staging environment, use it first.
4. Apply the patch as soon as it ships, from php.net or, better, from your distribution's or provider's channel. Then restart PHP-FPM or the web server: otherwise the old version keeps running.
5. Meanwhile, reduce exposure: restrict admin panels by IP, make sure your web application firewall (WAF) is on, turn off what you don't use, and watch server logs for unusual traffic.
6. If you're still on PHP 8.1 or older, that server won't get this patch. Plan the migration to a supported branch.

If your application is with SimCodec

If your team or application lives on a SimCodec instance, or SimCodec maintains it, our team will update it as soon as possible once the patch ships. There may be brief interruptions in the meantime. You don't need to do anything. If you have questions, write to us at simcod.ec/en/contacto.

Sources

• PHP Group, "Upcoming Critical PHP Security Release", php.net, October 20, 2026.
• PHP Group, Supported Versions (accessed 10/21/2026).
• PHP Group, Downloads (current versions before the patch).
• php/php-src, GitHub Security Advisories, where the details of each flaw are published.
• FIRST, CVSS v4.0 Specification Document (severity ranges).