PHP schedules patches for two critical flaws rated 9.2
PHP’s security team scheduled a release for 21 October 2026 at 14:00 UTC to fix two vulnerabilities, each rated 9.2 under CVSS v4.0. The team urged users to prepare to upgrade, but said affected versions, fixed releases and technical details would be published with the patches; it may release them earlier if details become public or active exploitation emerges.
Bottom line — PHP’s release notice confirms two 9.2-rated flaws, but not which versions are affected.
Go deeper 6
-
PHP has not confirmed the CVE identifiers circulating in public reports, according to Qualys.
-
watchTowr told BleepingComputer it believes the flaws are remote-code-execution vulnerabilities affecting PHP versions 5 through 8; PHP has not confirmed that scope.
-
The PHP security team’s official notice gives each flaw a CVSS v4.0 score of 9.2, rather than the 10.0 cited in some early reports.
-
watchTowr said it had not observed exploitation in the wild when it reported on the leak.
-
Qualys recommends inventorying PHP installations now, then checking the official affected-version list once it is published.
-
Qualys notes that PHP 8.1 and earlier are no longer supported upstream.