PHP schedules patches for two CVSS 9.2 critical vulnerabilities

cybersecurityscheduled2026-10-21 07:34:53 UTCimp 0.82RPD +0.45GDDY -0.40

PHP developers announced an official security release for two critical vulnerabilities, each rated 9.2 on the CVSS v4.0 scale, scheduled for 14:00 UTC on October 21, 2026. The European Union Computer Emergency Response Team said the rating indicated a risk of unauthenticated remote code execution and advised organizations unable to patch to consider taking affected internet-facing websites offline. PHP urged users to upgrade as soon as the fixes became available, while the Australian Cyber Security Centre said it was not aware of active exploitation at the time.

Occurred 2026-10-21 14:00:00 UTCSurprise 0.68Confidence 0.96

Rationale

This is a concrete, forward-looking cybersecurity development: PHP announced a scheduled security release for two critical vulnerabilities, while CERT-EU advised organizations unable to patch to isolate affected internet-facing applications. The release time is explicitly stated as 14:00 UTC on October 21, 2026, and the source was published before that time, so the status remains scheduled rather than occurred. Importance is high because PHP is widely deployed and the flaws may enable unauthenticated remote code execution, but it is below the maximum level because no active exploitation or compromise had been reported. Surprise is meaningful but not extreme because speculation about exposure had already circulated. Stakeholder approval is limited to GoDaddy, which faces direct hosting and availability implications, and Rapid7, which has a clear exposure-management and remediation-validation demand channel; other proposed stakeholders are too indirect or conditional.

EventsPHP Critical Vulnerability Patches and Upgrade Advisory

Evidence

EU agency warns websites may need to be taken offline as PHP prepares patches for vulnerabilities

reuters2026-10-21 07:27:01 UTCOpen source

The developers of the widely used PHP programming language said on Wednesday they would release patches for two critical vulnerabilities, as EU cybersecurity officials warned organisations unable to apply the fixes should take affected websites offline.

In a security update, PHP said both vulnerabilities were rated 9.2 on the CVSS v4.0 severity scale and urged users to "upgrade as soon as the release is available".

It said a patch for both vulnerabilities was scheduled for 1400 GMT on Wednesday.