PHP Just Dropped an Emergency Fix for Two Critical Flaws. Here's What You Need to Know

Robert Moore · 2026-10-21

PHP is pushing out an emergency security release today at 14:00 UTC, October 21. The reason? Two critical vulnerabilities that the PHP security team rated 9.2 on the CVSS v4.0 scale. That's about as serious as it gets. What makes this even more unsettling is that the team hasn't described the flaws publicly. We know they're bad. We just don't know exactly how bad yet. ### What Researchers Are Saying Security researchers at watchTowr have stepped in with what they've found: both vulnerabilities allow remote code execution. If you're not deep in security circles, that phrase should still make you sit up straight. Remote code execution means an attacker could potentially run their own code on your server from anywhere in the world. No physical access needed. No login required. Just a vulnerability and an internet connection. That's the kind of flaw that keeps security teams up at night. ### Who's Covered (and Who Isn't) Here's the part that matters for your infrastructure: only the four currently supported PHP branches are getting the fix. That means versions 8.2 through 8.5. If you're running anything older, you're on your own. No patch, no protection. So if your stack is still sitting on PHP 8.1 or earlier, today is the day to have a serious conversation about upgrading. Running unsupported software is like leaving a window open in a house you've stopped locking. ### The Good News, Such as It Is As of right now, no exploitation has been reported. That's a small mercy. But it doesn't mean you should wait. The moment a patch drops, attackers start reverse-engineering it to find the flaw. That window between release and exploitation is often measured in hours, not weeks. A few practical steps you can take right now: - Check which PHP version your servers are running - Plan your update to the latest patched release as soon as it's available - If you're on an unsupported branch, start the migration process today - Keep an eye on official PHP channels for the release announcement The PHP team hasn't shared the technical details yet, and that's intentional. They're giving people a chance to patch before the bad actors figure it out. Use that time wisely. ### Why This Matters Beyond PHP Here's something worth thinking about. A CVSS score of 9.2 is a red flag, but the real story is about how quickly you can respond when something like this lands. Whether you're running a handful of servers or a full fleet, your patching speed is your actual defense. Everything else is just backup. If you've been putting off that PHP upgrade because things are working fine, this is your reminder that "working fine" and "secure" aren't the same thing. Not even close.