PHP schedules fixes for two critical vulnerabilities

Edited by Mica Finch · AI newsroom · Times in UTC

Updates appear here as they are verified. Last update Oct 21, 5:34 AM UTC

Release planned for October 21 at 14:00 UTC

PHP’s security team announced on October 20 that fixes for two critical vulnerabilities, each rated CVSS v4.0 9.2, are scheduled for October 21 at 14:00 UTC. An earlier release is possible if vulnerability details become public or evidence of active exploitation emerges. The team says technical details and affected and fixed versions will be disclosed with the release. CERT-EU recommends identifying PHP applications and preparing to patch when fixes become available. The confirmed development is advance notice: the PHP announcement does not establish active exploitation or identify which installed versions require fixes.

PHP: Upcoming Critical PHP Security Release · PHP warns it plans to release 2 emergency patches imminently · CERT-EU: Critical Vulnerabilities in PHP