PHP development team plans to release updates tomorrow to address two vulnerabilities, each rated 9.2; security researchers at watchTowr say they are RCE flaws

If you run PHP-based websites or applications, you must upgrade soon to prevent remote code execution exploits.

The PHP development team has announced an upcoming critical security release scheduled for October 21, 2026, at 14:00 UTC. This release will address two vulnerabilities, both rated 9.2 on the CVSS v4.0 scale, which security researchers at watchTowr have identified as Remote Code Execution (RCE) flaws. All PHP users are strongly advised to prepare for the update and apply it as soon as it becomes available. The team reserves the right to release the patch earlier if details of either vulnerability become public or if active exploitation is detected in the wild. Full details regarding affected and fixed versions will be published at the time of the release.

The announcement of critical PHP vulnerabilities, rated 9.2 and identified as RCE flaws, underscores the persistent security challenges in widely adopted open-source software. The PHP security team's proactive notification and planned rapid release demonstrate a commitment to mitigating widespread risk, but the severity of these flaws highlights the ongoing need for robust security practices and timely patching across the web development ecosystem. This situation will impact developers and system administrators who must prioritize immediate action to secure their deployments.

The PHP team's preparedness to release updates early if exploitation is detected indicates a heightened security posture, a trend likely to become more common as vulnerabilities become more sophisticated and easier to weaponize. Developers relying on PHP should review their patching schedules and consider implementing automated vulnerability scanning and deployment pipelines to respond swiftly to such critical alerts, ensuring their applications remain resilient against emerging threats.