Critical PHP Security Release Coming Tomorrow (October 21)
The PHP security team has announced an upcoming release to address two critical remote code execution vulnerabilities. Developers are advised to prepare for updates to their environments, including potential redeployments for users of Laravel Forge and Cloud.
Why it matters
Critical vulnerabilities in widely used programming languages like PHP pose significant risks to global web infrastructure and application security.
Update October 21, 2026: PHP has new releases to Fix Two Critical RCE Vulnerabilities
The PHP security team has announced an upcoming security release that fixes two critical vulnerabilities. It is scheduled for Wednesday, October 21, 2026 at 14:00 UTC (10:00 AM Eastern).
Both vulnerabilities are rated 9.2 under CVSS v4.0. The team has not shared what the vulnerabilities are or which PHP versions they affect yet. From the announcement:
All PHP users are encouraged to prepare now so they can upgrade as soon as the release is available.
We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild.
The Laravel team announced both Forge and Cloud will be updated as well with a fix to a second node.js security issue:
Headlinne story · 7 newsrooms
Global Websites Go Dark After AI Uncovers Critical Programming Language Flaws
What every outlet reported, where they differ, and how each framed it →
Get smarter about the news
Sign up free for a feed built around what you actually care about, Dive Deeper research on any story, and the full text of every article.
Create free accountAlready have an account? Sign in