Critical PHP Security Release Coming Tomorrow (October 21)

The PHP security team has announced an upcoming security release that fixes two critical vulnerabilities. It is scheduled for Wednesday, October 21, 2026 at 14:00 UTC (10:00 AM Eastern).

Both vulnerabilities are rated 9.2 under CVSS v4.0. The team has not shared what the vulnerabilities are or which PHP versions they affect yet.