Sticky notes on a planning whiteboard. Photo: Akinyemi Gbadamosi via Unsplash , Unsplash License PHP's security team is shipping fixes for two critical flaws at 14:00 UTC on 21 October 2026, and the patch will only be built for PHP 8.2, 8.3, 8.4 and 8.5. If your product, clien…

php2shell: What PHP Has Confirmed. Graphic: Language Lassi PHP's security team has scheduled an out-of-band release for 21 October 2026 at 14:00 UTC to fix two flaws it rates 9.2 on CVSS v4.0. Researchers have nicknamed the pair php2shell, and a leaked post gave them the iden…

Hot-swap SAS drive bays in a server rack. Photo: Domaintechnik via Unsplash , Unsplash License PHP's security team has scheduled a release for 21 October 2026 at 14:00 UTC that fixes two critical remote code execution flaws, both rated 9.2 on CVSS v4.0. When we last checked ph…

PHP source code in an editor. Photo: Peter Masełkowski via Unsplash , Unsplash License On 20 October 2026 the PHP security team announced an out-of-cycle release for Wednesday 21 October at 14:00 UTC, fixing two vulnerabilities it rates CVSS v4.0 9.2. Before you can patch, you nee…

Hourglass with sand running out. Photo: Halil Celik via Unsplash , Unsplash License At 14:00 UTC on 21 October 2026 the PHP project is shipping fixes for two critical flaws, and only four branches will get them: 8.2, 8.3, 8.4 and 8.5. If a server of yours still answers with PHP 8.…