Upcoming critical PHP security release

PHP will release a critical security update on October 21, 2026 at 14:00 UTC to address two critical vulnerabilities both rated CVSS 9.2. All PHP users are urged to prepare for immediate update deployment, with the PHP security team reserving the right to release the patch earlier if the vulnerabilities become public or are actively exploited.