PHP is preparing a critical security update scheduled for October 21, 2026, after identifying two vulnerabilities that both carry a CVSS v4 score of 9.2, placing them in the critical severity category. The PHP Foundation announced the upcoming release on October 20, urging users to prepare to update immediately, and warned that the fixes could ship earlier than planned if exploit details become public or evidence of active exploitation emerges.

The release is set for 14:00 UTC, equivalent to 15:00 BST. Alongside the PHP Foundation's announcement, the United Kingdom's National Cyber Security Centre (NCSC) has urged organisations to identify vulnerable systems and prepare to apply the patches as soon as they become available. Where prompt remediation is not possible, the agency said, organisations should consider taking affected systems offline until the risks can be mitigated.

Advance Notice Gives Administrators a Preparation Window

The PHP Foundation's early warning is designed to give administrators time to prepare before the security fixes become available. Because the release could be pulled forward at short notice, preparation cannot wait until the patches are published.

PHP, or PHP Hypertext Preprocessor, is a server-side scripting language widely used to build websites and web applications. It processes backend logic, interacts with databases and generates dynamic content before sending pages to users' browsers. That widespread role makes PHP security important for organisations operating internet-facing websites and applications, since vulnerabilities in the language can expose the systems that depend on it, depending on the nature of the flaws and how exploitable they turn out to be.

The NCSC recommends identifying every system running PHP across an organisation's infrastructure, with internet-facing systems given priority because they are directly reachable from outside the organisation. Administrators should also monitor those systems for suspicious activity and follow official PHP guidance. The agency further advises continued monitoring for updates from third-party vendors whose products or services bundle PHP.

The PHP Foundation shared its advance notice on X:

The PHP security team is giving advance notice: Upcoming security release Wed, Oct 21st 2026, 14:00UTC, two critical vulnerabilities, both rated CVSSv4 9.2. PHP users are encouraged to prepare to update. Earlier release if details become public or active exploit evidence.

— The PHP Foundation (@ThePHPF) October 20, 2026

How the Update Could Affect Website Operators

The planned release creates an immediate preparation window for security teams, hosting providers and application operators. Once the patches become available, administrators should assess affected systems and install the appropriate updates promptly.

The PHP Foundation has also warned users who rely on the volunteer-maintained Remi RPM repository that updates will not be available there on release day. It recommends switching to distribution packages or building PHP from source to apply the fixes immediately. The warning matters for operators whose patching processes depend on that repository, since their ability to update quickly could hinge on arranging an alternative installation method in advance.

The NCSC additionally recommends taking systems offline when immediate remediation is not feasible. That precaution can reduce exposure while administrators work toward a complete fix, although it may disrupt website availability.

For crypto businesses, exchanges and wallet providers running PHP-based infrastructure, the same preparation principles apply. Any affected service could face security risks if administrators delay remediation after patches become available. The immediate priority is preparation, followed by rapid patching and continued monitoring.

Until the security release arrives and its technical details become public, administrators should follow official guidance from the PHP Foundation and the NCSC rather than assume which systems are vulnerable.

This article is based on reporting by Blockonomi.