PHP Will Patch Two Critical Flaws on October 21: What to Do

The PHP security team announced on October 20, 2026 that it will ship a release fixing two critical vulnerabilities on Wednesday, October 21, at 14:00 UTC. Any website running on PHP, including WordPress and Drupal sites, may be affected. The list of affected versions will come with the patch.

What we know

  • The notice: the php.net home page posted a notice titled "Upcoming Critical PHP Security Release" on October 20. The same text went out on the PHP announcements list, on the PHP Foundation forum, at 19:33 UTC.
  • The time: the release is scheduled for Wednesday, October 21, 2026, at 14:00 UTC. That is 10:00 in New York, 7:00 in Los Angeles, 15:00 in London and 19:30 in New Delhi, by this article's conversion.
  • The severity: there are two vulnerabilities, each rated 9.2 out of 10 on CVSS v4.0, which is critical, according to the notice.
  • What is missing: the notice says full details, affected versions and fixed versions will be published with the release. Which PHP branches are affected is not known yet.
  • It could come early: the PHP team says it will release sooner if details become public or if there is evidence of active exploitation.
  • Supported branches: according to the official php.net table, PHP 8.2, 8.3, 8.4 and 8.5 currently receive security fixes. PHP 8.2 gets them until December 31, 2026. PHP 8.1 and older are no longer in that table.

What changes and what doesn't

There is nothing to install today. The patch does not exist until Wednesday at 14:00 UTC.

What changes is the time you have. The PHP team asks users to prepare now so they can update as soon as the release is out. Once the details of a critical flaw are public, anyone can study them, and sites that update late are more exposed.

Other severity scores and vulnerability IDs are circulating on social media. The only official source is the PHP notice, which says 9.2 and has not published IDs yet.

A site on PHP 8.1 or a 7.x version is not on php.net's table of supported versions. If the flaws also affect it, there will be no official patch. Some hosting providers and Linux distributions maintain their own fixes for older versions, so it is worth asking.

How to tell if you're affected

  1. Check which PHP version your site runs. In WordPress: Tools → Site Health → Info → Server. In Drupal: Reports → Status report. Many hosting control panels also show it in the PHP version selector.
  2. If you see 8.2, 8.3, 8.4 or 8.5, your branch is supported. When Wednesday's release is out, check whether your branch is on the fixed list and update to that version.
  3. If you see 8.1 or lower, your site already runs on a version without official fixes. This is a good moment to plan a move to PHP 8.3 or 8.4, after checking that your WordPress or Drupal install and its plugins or modules support it.
  4. If you are on shared hosting, PHP updates are in your provider's hands. Ask today: "Will you apply the October 21 PHP security release on my plan, and when? Which PHP version am I on, and is it supported?"
  5. If you run your own server or VPS, whoever manages it should have the PHP package update ready for Wednesday. Linux distributions usually publish their own patched packages, sometimes hours or days later.
  6. Back up first. A security update within the same branch rarely breaks anything, but a recent copy of your files and database lets you roll back if something goes wrong.
  7. Then check the site. Open your key pages and test forms and checkout. Over the following days, watch the crawl stats report in Search Console for server errors.

Related: PHP 8.6 RC3 Is Out, PHP 8.2 Ends Dec 31: Check Your Site

Sources

Updates: the fixed versions and affected branches will be added here when PHP publishes the security release.