<![CDATA[The PHP security team is giving advance notice of an upcoming security release scheduled for Wed, 21 October 2026 at 14:00 UTC, addresses two critical vulnerabilities, both rated CVSSv4 9.2.]]>The PHP security team is giving advance notice of an upcoming security release scheduled for Wed, 21 October 2026 at 14:00 UTC, addresses two critical vulnerabilities, both rated CVSSv4 9.2.

All PHP users are encouraged to prepare so they can upgrade immediately tomorrow. Should details of the vulnerabilities become public, or should evidence of active exploitation appear we will release sooner.

Full details, affected versions, and the fixed versions will be published with the release.

]]>https://forum.fedi.dk/topic/fd393856-1d3d-4fce-a86d-a7ccde8aa21b/the-php-security-team-is-giving-advance-notice-of-an-upcoming-security-release-scheduled-for-wed-21-october-2026-at-14-00-utc-addresses-two-critical-vulnerabilities-both-rated-cvssv4-9.2.RSS for NodeFri, 23 Oct 2026 13:30:22 GMTTue, 20 Oct 2026 19:51:49 GMT60<![CDATA[Reply to The PHP security team is giving advance notice of an upcoming security release scheduled for Wed, 21 October 2026 at 14:00 UTC, addresses two critical vulnerabilities, both rated CVSSv4 9.2. on Wed, 21 Oct 2026 09:11:11 GMT]]>@php
Nice, I am offline for the next 4 days. So nothing is going to be patched until next week. 😐

]]>https://forum.fedi.dk/post/https://mastodon.opencloud.lu/users/gunstick/statuses/117478121263587795https://forum.fedi.dk/post/https://mastodon.opencloud.lu/users/gunstick/statuses/117478121263587795Wed, 21 Oct 2026 09:11:11 GMT<![CDATA[Reply to The PHP security team is giving advance notice of an upcoming security release scheduled for Wed, 21 October 2026 at 14:00 UTC, addresses two critical vulnerabilities, both rated CVSSv4 9.2. on Wed, 21 Oct 2026 08:52:02 GMT]]>@php Thank you for the update. I have a friend that's stuck on an older shared server which is running PHP 7.4 😬😬 I'm assuming because that's EOL it won't receive a patch in this case?

]]>https://forum.fedi.dk/post/https://mastodon.social/users/ebauche/statuses/117478045941781892https://forum.fedi.dk/post/https://mastodon.social/users/ebauche/statuses/117478045941781892Wed, 21 Oct 2026 08:52:02 GMT<![CDATA[Reply to The PHP security team is giving advance notice of an upcoming security release scheduled for Wed, 21 October 2026 at 14:00 UTC, addresses two critical vulnerabilities, both rated CVSSv4 9.2. on Wed, 21 Oct 2026 08:41:36 GMT]]>@php at this stage, maybe earlier release would be somehow good.

given the idiots who made (part of) it public 😕

]]>https://forum.fedi.dk/post/https://phpc.social/users/pierre/statuses/117478004896344741https://forum.fedi.dk/post/https://phpc.social/users/pierre/statuses/117478004896344741Wed, 21 Oct 2026 08:41:36 GMT<![CDATA[Reply to The PHP security team is giving advance notice of an upcoming security release scheduled for Wed, 21 October 2026 at 14:00 UTC, addresses two critical vulnerabilities, both rated CVSSv4 9.2. on Wed, 21 Oct 2026 08:24:38 GMT]]>@colin_mcmillen @dbs @php People who compile PHP from source in prod:

]]>https://forum.fedi.dk/post/https://mastodon.social/users/richlv/statuses/117477938220973517https://forum.fedi.dk/post/https://mastodon.social/users/richlv/statuses/117477938220973517Wed, 21 Oct 2026 08:24:38 GMT<![CDATA[Reply to The PHP security team is giving advance notice of an upcoming security release scheduled for Wed, 21 October 2026 at 14:00 UTC, addresses two critical vulnerabilities, both rated CVSSv4 9.2. on Wed, 21 Oct 2026 07:09:10 GMT]]>@nextcloud any update regarding the official docker images would be appreciated, too.

]]>https://forum.fedi.dk/post/https://mastodon.de/users/spitfire/statuses/117477641454200030https://forum.fedi.dk/post/https://mastodon.de/users/spitfire/statuses/117477641454200030Wed, 21 Oct 2026 07:09:10 GMT<![CDATA[Reply to The PHP security team is giving advance notice of an upcoming security release scheduled for Wed, 21 October 2026 at 14:00 UTC, addresses two critical vulnerabilities, both rated CVSSv4 9.2. on Tue, 20 Oct 2026 20:45:32 GMT]]>@dbs @php We have been coordinating with distros

]]>https://forum.fedi.dk/post/https://phpc.social/users/edorian/statuses/117475189244501154https://forum.fedi.dk/post/https://phpc.social/users/edorian/statuses/117475189244501154Tue, 20 Oct 2026 20:45:32 GMT<![CDATA[Reply to The PHP security team is giving advance notice of an upcoming security release scheduled for Wed, 21 October 2026 at 14:00 UTC, addresses two critical vulnerabilities, both rated CVSSv4 9.2. on Tue, 20 Oct 2026 20:41:47 GMT]]>@Girgias thanks
@dbs @php

]]>https://forum.fedi.dk/post/https://piaille.fr/users/colin_mcmillen/statuses/117475174489510195https://forum.fedi.dk/post/https://piaille.fr/users/colin_mcmillen/statuses/117475174489510195Tue, 20 Oct 2026 20:41:47 GMT<![CDATA[Reply to The PHP security team is giving advance notice of an upcoming security release scheduled for Wed, 21 October 2026 at 14:00 UTC, addresses two critical vulnerabilities, both rated CVSSv4 9.2. on Tue, 20 Oct 2026 20:39:48 GMT]]>@dbs @php Yes they are.

]]>https://forum.fedi.dk/post/https://phpc.social/users/Girgias/statuses/117475166693121017https://forum.fedi.dk/post/https://phpc.social/users/Girgias/statuses/117475166693121017Tue, 20 Oct 2026 20:39:48 GMT<![CDATA[Reply to The PHP security team is giving advance notice of an upcoming security release scheduled for Wed, 21 October 2026 at 14:00 UTC, addresses two critical vulnerabilities, both rated CVSSv4 9.2. on Tue, 20 Oct 2026 20:39:15 GMT]]>@dbs @php I ******* hope so, who exactly installs php from source in prod

]]>https://forum.fedi.dk/post/https://piaille.fr/users/colin_mcmillen/statuses/117475164525473183https://forum.fedi.dk/post/https://piaille.fr/users/colin_mcmillen/statuses/117475164525473183Tue, 20 Oct 2026 20:39:15 GMT<![CDATA[Reply to The PHP security team is giving advance notice of an upcoming security release scheduled for Wed, 21 October 2026 at 14:00 UTC, addresses two critical vulnerabilities, both rated CVSSv4 9.2. on Tue, 20 Oct 2026 20:30:06 GMT]]>@php thank you for the heads up. Are distro packagers in the loop and expected to make packages available at the same time, or are those expected to lag?

Edit: s/after/are/; s/redirected/expected/

]]>https://forum.fedi.dk/post/https://code4lib.social/users/dbs/statuses/117475128571902384https://forum.fedi.dk/post/https://code4lib.social/users/dbs/statuses/117475128571902384Tue, 20 Oct 2026 20:30:06 GMT