The PHP security team has issued a formal announcement regarding an upcoming critical security release. The update is scheduled to be deployed on Wednesday, October 21, 2026, at 14:00 UTC. This release specifically addresses two vulnerabilities, both of which have been assigned a CVSS v4.0 score of 9.2, categorizing them as 'Critical.' The team has advised all PHP users to prepare for the update immediately, noting that the release may be moved forward if evidence of active exploitation in the wild emerges or if further details of the vulnerabilities become public.
The PHP security team has issued a formal announcement regarding an upcoming critical security release.
Technical discussions surrounding the announcement highlight the severity of the situation, with some observers suggesting the vulnerabilities could be among the most significant in the language's history. Reports from the community indicate that proof-of-concept exploits have already been circulated, with some users claiming to have successfully used them to dump databases from personal sites. The rapid appearance of these exploits, even before the official patch, has prompted some administrators to take the drastic step of taking their websites offline entirely until the security update can be applied.
For those unable to take their services offline, several temporary mitigation strategies have been discussed by the community. One suggested method involves modifying the `php.ini` configuration to set `session.upload_progress.enabled` to `Off` and potentially setting `file_uploads` to `Off`. Another technical approach involves blocking multipart requests at the web server level or using a Web Application Firewall (WAF) to reject `POST`, `PUT`, `PATCH`, and `DELETE` requests. While these measures may disrupt standard form functionality, such as login pages, they are proposed as a way to maintain a site's presence while awaiting the official patch. However, some users have expressed uncertainty regarding the effectiveness of these mitigations, noting that certain serialization processes might still be vulnerable even with these settings adjusted.