Security · PHP

PHP pre-announces a critical security release for 21 October, 14:00 UTC

The PHP security team will publish a security release on Wednesday 21 October at 14:00 UTC with fixes for two vulnerabilities rated CVSS v4.0 9.2. Affected versions, CVE ids and fixed builds come with the release, so the task now is to know which PHP your services run.

By BoneTuesday 20 October 20262 min readSecurity

entryread only

filedTuesday 20 October 2026

length2 min

sectionSecurity

subjectPHP

sourceson the page

This is a pre-announcement: nothing has been released yet. The PHP security team says its next security release is scheduled for Wednesday, 21 October 2026 at 14:00 UTC, and that it addresses “two critical vulnerabilities, both rated CVSS v4.0 9.2.” That is the whole public brief. “Full details, affected versions, and the fixed versions will be published with the release,” so there are no CVE identifiers, no list of affected versions and no technical detail to report today.

Find your PHP before the release

The notice asks all PHP users to “prepare now so they can upgrade as soon as the release is available,” and the useful preparation is knowing what you are running. On a host, php -v answers it; on a web server, so does a phpinfo() page. In containers, the version is the image tag in your compose file or deployment manifest, and in distribution installs it is the package: dpkg -l 'php8.*' on Debian-derived systems, dnf list installed 'php*' on Fedora-derived ones.

Some appliance-style images ship their own PHP rather than taking it from a package or a base image. Those wait for their maintainer, so it helps to know now which of your services are in that category. A backup or snapshot you could restore if an update goes wrong is the other thing to have ready, and it is cheaper to take one before the patch window than during it.

Why the early notice

Pre-announcing a critical fix is a deliberate move: it gives administrators a window to prepare rather than meeting the update mid-week. The team is also keeping its options open. “We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild,” the notice says, so 14:00 UTC is a plan, not a promise.

What to expect

PHP is the runtime under a large share of self-hosted web software, and this fix is a runtime update, not an application patch. The current supported branches are 8.2 through 8.5, with 8.6 still in release-candidate testing, but the notice does not say which branches receive fixes on the day or when distribution packages and container images will follow. Those move on their own schedules, so watch the PHP news page and your distribution’s security tracker rather than assuming the package appears at 14:00 UTC.

The sentence to act on is short: a critical PHP fix lands on Wednesday at 14:00 UTC. Find out which PHP your services run before then, and have the backup ready, so that the update is a scheduled task rather than a surprise.

Sources: the PHP news archive entry and the supported versions page.

SecurityPyPI's new Security tab says where a release came from, and that is not a verdictPyPI's redesigned project pages went live on 6 November with a Security tab that reports a release's provenance: full, none, incomplete, inconsistent, changed or lost. The post is explicit that no provenance does not mean malicious, that it means the file origin cannot be cryptographically verified, and that the states worth checking before you install are the warnings.

SecurityPwnEscape Part 2: from a Firecracker guest to root on the host, in a setup without the jailerThe researchers behind October's kernel bug have published the other half: using that host-memory primitive to find Firecracker in memory, take over a live vCPU thread and redirect its return from KVM to a call of their choosing, with the VM left running and reachable. Their test used Firecracker v1.16.1 with the VMM launched as root and no jailer, and they say a jailer-hardened deployment needs a separate assessment. No new CVE, no vendor advisory and no Firecracker fix appears in the source.