Commit

The PHP security team would like to give advance notice of an upcoming security release. It is scheduled for Wed, Oct 21st 2026 at 14:00 UTC. It addresses two critical vulnerabilities, both rated CVSS v4.0 9.2. All PHP users are encouraged to prepare to update. Earlier release if vulnerability details become public or evidence of active exploitation. Full details, affected versions, and the fixed versions will be published with the release.