PHP schedules fixes for two critical vulnerabilities

PHP’s security team has scheduled fixes for two critical vulnerabilities for October 21, 2026, at 1400 UTC, while the flaws’ technical details and affected versions remain undisclosed. The team rated each vulnerability 9.2 under CVSS v4.0 and said it would publish the scope and fixed releases with the patches. The release is intended to address vulnerabilities in the widely used programming language, which powers websites and web applications. PHP urged users to upgrade as soon as fixes become available. Its notice also reserved the option to release earlier if details became public or evidence of active exploitation emerged. The announcement does not establish which installations are vulnerable or how the flaws can be exploited. Security researchers at watchTowr have described both as remote-code-execution vulnerabilities, but PHP has not confirmed that characterization or disclosed the technical requirements. The researchers said the affected range had not been officially confirmed and that they had not observed exploitation. PHP’s official severity rating is 9.2 for each flaw. A leaked forum post and researchers described the vulnerabilities as having a 10.0 score, but that...