PHP plans out-of-cycle release for two critical RCE flaws rated 9.2

Past-week coverage · Original source published 2026-10-21.

PHP said it would ship an out-of-cycle security release at 14:00 UTC on October 21, 2026, covering two critical vulnerabilities that its security team rated 9.2 on the CVSS v4.0 scale. As of the report, PHP had not described the flaws.

Researchers at watchTowr said the two vulnerabilities allow remote code execution. The report did not include technical detail on how either flaw works, which components are affected, or what an attacker would need to reach them.

The fix is limited in reach. Only the four supported PHP branches, 8.2 through 8.5, can receive it, so anyone running an older branch has no patched version to move to. No exploitation had been reported at the time of the report.

Why it matters

PHP runs a large share of the web, and a remote code execution flaw in the interpreter is about as serious as web software bugs get. Two of them arriving together, with a severity rating this high and no public description yet, leaves administrators planning around a release they can't fully assess in advance.

What defenders can do

• Confirm which PHP branch each internet-facing application runs, and note any that fall outside 8.2 through 8.5.
• Plan to apply the out-of-cycle release promptly once it lands, and watch for PHP's advisory for affected components and version details.
• Treat the absence of reported exploitation as a snapshot, not a guarantee. The report gives no basis for assuming the flaws will stay unexploited.

The report did not name the affected components, give a CVE identifier, or say whether the flaws are related. Those details should come from PHP's own advisory.