PHP Preps Emergency Patch for Dual 9.2 Flaws
The PHP team has scheduled an emergency security release for October 21, 2026, at 14:00 UTC to address two critical vulnerabilities rated 9.2 on the CVSS v4.0 scale.
Maintainers of PHP have scheduled an emergency security update for October 21, 2026, at 14:00 UTC to address two critical security flaws. Both issues received a severity score of 9.2 under CVSS v4.0, placing them near the top of the risk scale.
Technical specifics regarding the flaws remain under strict embargo. The core team indicated that withholding details is necessary to prevent threat actors from reverse-engineering the bugs and weaponizing exploits before official fixes are published. However, the release timeline is conditional: if actionable details leak publicly or in-the-wild exploitation begins, maintainers plan to push the update ahead of schedule.
With details withheld, system administrators cannot evaluate whether specific configurations or extensions mitigate the risk. Site operators and infrastructure teams are advised to monitor official project channels and deploy the incoming release as soon as it goes live.
Source: habr
Comments
Help shape the next version: Add context or suggest a correction. AI review can add points toward a rewrite. Reviews and updates may take time; a full meter does not guarantee a new version.