PHP Team Warns of Critical Security Update Fixing Two High-Severity Flaws
The PHP project announced a Wednesday release addressing two vulnerabilities rated 9.2 on the CVSS v4.0 scale, impacting WordPress and other platforms.
Key points
- The update is scheduled for October 21, 2026, at 14:00 UTC.
- Two critical vulnerabilities are being patched in this release.
- Both flaws receive a severity score of 9.2 on the CVSS v4.0 scale.
The PHP development team announced that a critical security release is scheduled for Wednesday, October 21, 2026, at 14:00 UTC. This update addresses two significant vulnerabilities that affect the core programming language used by millions of websites globally.
According to an advisory posted on the oss-security mailing list by Alan Coopersmith, the release is confirmed for that specific date and time. Wordfence, a security firm that monitors web threats, also published a public service announcement detailing the upcoming patch. Both sources confirm that the two fixed vulnerabilities are rated 9.2 on the CVSS v4.0 scale, indicating a high level of severity.
Context and Background
The PHP security team issued this advance notice to allow administrators to prepare for the update. The advisory was shared on October 20, 2026, via the official PHP archive and the oss-security mailing list. This early warning is standard procedure for critical releases that require immediate attention from system operators.
Wordfence highlighted the broad impact of PHP in its blog post. Because PHP is the underlying language for WordPress, every WordPress site runs on this codebase. Consequently, any critical flaw in PHP poses a direct risk to the vast ecosystem of websites built on WordPress and other PHP-dependent frameworks.
Who Is Affected
Any organization running services powered by PHP is potentially affected by these two vulnerabilities. This includes all WordPress sites, as well as custom applications and other content management systems that rely on the PHP interpreter. The severity rating of 9.2 suggests that these flaws could have significant consequences if exploited by attackers.
The oss-security mailing list advisory provides the primary technical notification for security researchers and sysadmins. Wordfence’s report serves as a secondary alert for the broader web security community, emphasizing the connection between PHP updates and WordPress security posture. No specific CVE identifiers were included in the provided source material.
What should you do?
Administrators should prepare their systems to receive the update on October 21, 2026. Since no fix has been confirmed yet prior to the release time, organizations should monitor official channels for the availability of the patch. Once the vendor provides an update, applying it promptly is essential to mitigate the risk associated with the high-severity flaws.
What to do and how to stay safe: PHP
- Monitor official PHP channels for the release of the patch on October 21, 2026.
- Test the update in a staging environment before deploying it to production servers.
- Ensure your backup systems are current before applying any core language updates.
- Review server logs for any unusual activity that might indicate exploitation attempts.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
When is the critical PHP security release happening?
The release is scheduled for Wednesday, October 21, 2026, at 14:00 UTC.
How severe are the vulnerabilities being fixed?
Both vulnerabilities are rated 9.2 on the CVSS v4.0 scale, which is considered critical.
Does this affect WordPress sites?
Yes, because WordPress is built on PHP, every WordPress site runs on this language and is affected.
