PHP ships fixes for two critical flaws at 10 AM ET today. Find every server that runs it before then

PHP runs a large share of the web, from WordPress and Drupal sites to Laravel apps, shop platforms and internal tools. Its security team says a release fixing two critical vulnerabilities goes out today, Wednesday, at 14:00 UTC, which is 10:00 AM Eastern.

The team has not said which versions are affected or what the bugs do. Researchers at watchTowr told BleepingComputer the details leaked ahead of an embargo and that both are remote code execution flaws. The hours before the release are the time to find out where PHP runs in your shop and who will install the update.

PHP’s fix lands at 10 AM Eastern today. The useful work before then is a list: every server, container and hosting account that runs PHP, and who updates each one.

The 5-Minute Cyber Brief

Don’t Miss the Policy Changes That Affect Security Decisions

Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.

Email addressSend me tomorrow’s brief

By subscribing you agree to our Privacy Policy.

Free. Weekday mornings. 5 minutes or less.

PHP will publish fixes for two critical flaws at 14:00 UTC

On October 20 the PHP security team posted advance notice of a security release scheduled for Wednesday, October 21, 2026 at 14:00 UTC. It addresses two critical vulnerabilities, both rated 9.2 under CVSS v4.0. The team said full details, affected versions and fixed versions will be published with the release.

PHP added that it may ship earlier “should details of either vulnerability become public, or should evidence of active exploitation appear in the wild.” Oracle’s Alan Coopersmith forwarded the notice to the oss-security mailing list the same day.

watchTowr CEO Benjamin Harris told BleepingComputer the flaws are real, are understood to affect PHP 5 through 8, and that his team believes it has reproduced one of them. watchTowr said it had not seen exploitation in the wild. PHP’s own notice gives no version range.

Every site and app running PHP 8.2 to 8.5, and older branches with no fix

php.net lists four supported branches: 8.2 (security fixes until December 31, 2026), 8.3, 8.4 and 8.5. Branches older than 8.2 are end of life on php.net’s schedule, so a server still on PHP 7.4 or 8.1 should not expect an official fix from the PHP project.

CERT-EU published an advisory telling organisations to prepare for immediate patching and, where that is not possible, to consider isolating internet-facing PHP applications until a fix is applied. Once the patch is public, comparing old and new code is how attackers usually find the bug, so the gap between release and your update matters.

List your PHP servers this morning and book the update for this afternoon

• Run php -v on every web server, and check PHP-FPM, Apache mod_php and container base images separately. Note where each install comes from: your Linux distribution, a vendor repository, the official Docker image or a hosting panel.
• Book a change window for this afternoon. Builds from php.net come first; distribution and Docker image packages follow on their own schedules, so watch each source you use.
• Ask managed WordPress or shared hosting providers when they will roll the update to your accounts, and get the answer in writing.
• For servers on PHP 8.1 or older, pick a plan today: upgrade to a supported branch, buy extended support from a vendor that offers it, or take the app off the public internet.

Details

• Release: Wednesday, October 21, 2026, 14:00 UTC (10:00 AM EDT), per the PHP security team. Two vulnerabilities, each CVSS v4.0 9.2.
• Affected versions: not yet published by PHP. watchTowr says PHP 5 through 8. Supported branches per php.net: 8.2, 8.3, 8.4, 8.5.
• Exploitation: none reported as of October 20, according to watchTowr. PHP says it may release early if exploitation appears.

Hunt / verify

• Check what your public sites announce: run curl -sI against each site and look for an X-Powered-By header, which shows the PHP version on many default setups. Turn off expose_php afterwards.
• Search container registries and CI files for php: base image tags, and rebuild images after the update rather than patching running containers.
• After updating, restart PHP-FPM or the web server and confirm the new version with php -v and a phpinfo page that only admins can reach.

Source: PHP security team notice; BleepingComputer, October 20, 2026

Sources

• PHP: Upcoming Critical PHP Security Release
• PHP: Supported Versions
• oss-security: Upcoming Critical PHP Security Release
• BleepingComputer: PHP warns admins of two critical flaws, emergency patches coming tomorrow
• CERT-EU: Critical Vulnerabilities in PHP (2026-018)

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].