Update: PHP updates are live. Update now https://www.php.net/archive/2026.php#2026-10-21-5

PHP has announced an upcoming security release, scheduled for today, 21 October. It will fix two severe vulnerabilities that affect all versions of PHP.

Changes to PHP configuration and web application firewall (WAF) rules can help reduce exposure to the known attack vectors. However, the PHP team has said these measures don’t give full protection. The only full fix is to update PHP itself.

If you run PHP, apply the updates as soon as they’re released. Treat this as emergency maintenance and plan to roll the updates out across all your environments.

What to do now

• Get your environments ready to update straight away. Attacks on the known vectors have already started. Once the patch is public, attackers will use it to work out the remaining vectors, so expect a new wave of attacks as soon as it’s released.
• Ask your hosting provider what they’re doing to protect you, both at the WAF level and in your PHP configuration.
• Apply the PHP updates as soon as they’re released. Treat this as emergency maintenance and roll the updates out across all your environments.

Fixes are expected for PHP 8.2, 8.3, 8.4 and 8.5, which are the currently supported versions. PHP 8.1 is not expected to get a patch, so if you’re still on 8.1, upgrade to PHP 8.2 or later straight away.