New Delhi, Oct. 21 -- 00 a.m. EDT on October 21, equivalent to 14:00 UTC. The PHP security team says it will disclose affected and fixed versions with the release, rather than identifying them in advance.

The official notice confirms two vulnerabilities rated CVSS v4.0 9.2. The PHP Foundation repeated the warning on X. At the latest pre-release check, PHP's website still described the update as forthcoming; existing downloads should not be mistaken for the promised fixes.

The PHP security team is giving advance notice: Upcoming security release Wed, Oct 21st 2026, 14:00UTC, two critical vulnerabilities, both rated CVSSv4 9.2.

PHP users are encouraged to prepare to update. Earlier release if details become public or active exploit evide...