Critical vulnerability pre-announcement for all PHP versions

Published On20 Oct 2026

Critical PHP vulnerability affecting PHP 5, 7, and 8

On 21 October, 2026, there will be a security release for PHP 8.2, 8.3, 8.4, and 8.5 fixing a critical vulnerability in PHP.

The security release is scheduled to 14:00 UTC, October 21, 2026.

Note that this security vulnerability affects previous PHP versions such as PHP 8.1, PHP 8.0, and all previous PHP versions too. However, those versions are no longer supported and will not receive fixes for this vulnerability. Individual distributions may backport the security fixes, but it is not guaranteed and no prior communication has been made to the official PHP announcement channels yet.

Full details of the vulnerability and mitigation factors will be published on PHP.Watch as well as php.net once the fixes are released.

  • Docker images of the new releases will be published shortly after the release.
  • Debian/Ubuntu packages will be made available soon after the release on ondrej PPA and DPA.
  • RPM packages on remirepo are not scheduled to receive updates at this moment.
  • Homebrew and GitHub Actions setup-php action will receive updates shortly after the release too.

If possible, it is recommended to shut down any public-facing PHP servers until the updates are applied.

Further details will be made once the fixes are released, after 14:00 on 2026-10-21.

In other news on PHP.Watch

All News • Feed
PHP 8.1 reached its End-of-Life

PHP 8.1 reached its End-of-Life

PHP 8.1, released back in 2021, completed its life cycle and reached its End-of-Life.
Install PHP on Windows: PHP now available on Winget

Install PHP on Windows: PHP now available on Winget

The latest supported PHP packages are now available on Winget to easily install and update PHP on Windows.
PHP 8.4 Feature-freeze, first Release Candidate released

PHP 8.4 Feature-freeze, first Release Candidate released

The first release candidate of the upcoming PHP 8.4 is now out. PHP8.4-RC1 previews all new features, changes, and deprecations available on PHP 8.4, and can be used to test the compatibility of applications with PHP 8.4.
Subscribe to PHP.Watch newsletter for monthly updates

You will receive an email on last Wednesday of every month and on major PHP releases with new articles related to PHP, upcoming changes, new features and what's changing in the language. No marketing emails, no selling of your contacts, no click-tracking, and one-click instant unsubscribe from any email you receive.