Skip to content
Hacker Posts

PHP ships emergency release for two critical flaws (CVSS 9.2)

PHP will publish an out-of-cycle security release at 14:00 UTC on Oct 21 for two flaws it rates CVSS 9.2. Only branches 8.2–8.5 get the fix. Prepare to patch.

Published 3 min read
phpadvisoryrcepatch

PHP will ship an out-of-cycle security release today, Wednesday 21 October 2026 at 14:00 UTC, for two vulnerabilities its security team rates 9.2 on CVSS v4.0 but has not yet described. The advance notice went up on php.net on 20 October at 19:33 UTC and says only that "full details, affected versions, and the fixed versions will be published with the release." If you run PHP in production, the action today is preparation, not patching — the fix does not exist yet.

What PHP has confirmed

The primary source is PHP's own pre-announcement, titled "Upcoming Critical PHP Security Release." It states two things and little else:

  • The release "addresses two critical vulnerabilities, both rated CVSS v4.0 9.2."
  • PHP reserves "the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild."

PHP has published no CVE identifiers, no affected-version list, and no workaround. Security researchers at watchTowr, reported by The Hacker News, say the two flaws allow remote code execution. That characterisation is watchTowr's, not PHP's.

What is not confirmed

Unverified CVE identifiers and a claimed CVSS of 10.0 are circulating from a leaked Hacker News post. PHP's notice names neither, and watchTowr's own FAQ calls the leak's claims — including a scope of "PHP 5 onward" — unconfirmed by any vendor advisory. We are not printing those identifiers until PHP or the NVD publishes them. Treating a leaked number as fact is exactly how a bad patch window starts.

Which branches get the fix

Only the four supported branches can receive the release: PHP 8.2, 8.3, 8.4 and 8.5. As of the 24 September releases, the current versions were 8.5.11, 8.4.26, 8.3.35 and 8.2.34. Branches 8.1, 8.0, 7.x and 5.x are end of life and will get no PHP fix — if you are still on one, this release is also a reminder that you are now permanently exposed to whatever these two flaws are.

Exploitation status

No exploitation has been reported. watchTowr had seen none as of 21 October; Huntress reported none as of 20 October. The flaws are not in CISA's KEV catalog. That can change the moment the patch lands and the diff becomes public — the window between a security release and a working exploit for a server-side RCE is typically hours, not days.

Action checklist

  1. Inventory every internet-facing host and container image running PHP, and record the exact branch and version on each.
  2. Stage the upgrade now: confirm your 8.2/8.3/8.4/8.5 deployment can move to the next patch release the moment it ships at 14:00 UTC.
  3. If you run an end-of-life branch (8.1 or older), plan the jump to a supported branch — no fix is coming for you.
  4. Watch php.net and the release announcement at 14:00 UTC for the affected-version list and fixed versions, then patch internet-facing systems first.
  5. After the diff is public, assume reverse-engineering is under way; monitor your WAF and application logs for anomalous requests against PHP endpoints.

Context

A coordinated, pre-announced out-of-cycle release across every supported PHP branch is rare, and the 9.2 rating is the signal that matters more than any leaked number. The honest read today is narrow: PHP has told the world a server-side critical is coming and given eight hours' notice. Use them to line up the upgrade, not to speculate on identifiers that even the researchers tracking the flaws decline to confirm.

Related stories