We want to inform you of an upcoming PHP security release that addresses two critical vulnerabilities (both rated CVSS v4.0 9.2, Critical).
The release is scheduled for Wednesday, 21 October 2026 at 14:00 UTC. We encourage all PHP users to prepare now so you can update as soon as it is available.
We reserve the right to release earlier if details of either vulnerability become public, or if we see evidence of active exploitation in the wild.
The PHP security team