Critical PHP Security Updates Expected October 21
The PHP Security Team has announced an upcoming security release addressing two critical vulnerabilities affecting PHP, a widely used programming language that powers websites and web applications.
Both vulnerabilities have received a CVSS severity score of 9.2 out of 10. Early reporting from security researchers suggests the vulnerabilities may allow remote code execution (RCE), potentially enabling attackers to run unauthorized code on affected systems.
The security updates are scheduled for Wednesday, October 21, 2026, at 14:00 UTC (10:00 AM Eastern).
Full technical details and confirmed affected versions are expected with the official release.
Who may be affected?
Organizations running PHP-based websites, applications, or servers should review their environments for potential exposure.
PHP is commonly used in content management systems such as WordPress, custom business applications, and other web services.
The reported vulnerability scope includes PHP 5 and newer, meaning even older applications and websites should be evaluated for potential exposure. However, the PHP Security Team has not yet officially confirmed the affected versions.
Joe Ferguson, a contributor to the PHP project, emphasized the scope of the issue in a recent discussion, stating: “Are you running PHP? You're impacted.”
In practical terms, organizations should assume that any website or application running PHP may be vulnerable until confirmed otherwise.
Official security patches are expected to be limited to PHP 8.2 and newer, according to PHP contributor Morrison Levi. Organizations operating earlier versions should not expect official upstream fixes for these vulnerabilities.
Some Linux distributions and third-party vendors may provide security updates for older PHP releases. Administrators should check with their software vendors or hosting providers to determine whether a supported fix will be available.
We strongly recommend always running a supported version of PHP. Unsupported versions no longer receive official security updates, leaving organizations exposed to newly discovered vulnerabilities without a reliable path to remediation.
Systems running unsupported versions should be prioritized for upgrades to a currently supported release. Where an immediate upgrade or security fix is not possible, administrators should consider temporarily restricting public access until the system can be properly secured.
Source: PHP Patch Availability Discussion
Recommended Next Steps
While additional information is pending, organizations and IT administrators should begin preparing:
Identify PHP installations. Review websites, applications, and servers to determine where PHP is being used, including older applications.
Check installed versions. Document PHP versions, paying particular attention to systems running PHP 5 through PHP 7, which no longer receive upstream security updates.
Prepare for the October 21 release. Security patches are scheduled for 14:00 UTC (10:00 AM Eastern). Review the official advisories and prioritize updates to affected systems once available.
Plan upgrades for unsupported versions. Older PHP installations may require application compatibility testing, code changes, or migration to supported PHP 8 versions.
Verify backups and compatibility. Ensure current backups are available and confirm application compatibility before deploying updates.
What Happens Next?
The PHP Security Team is expected to publish updated releases and additional vulnerability details on October 21.
As reported by RuntimeWire, early security research has raised concerns about potential remote code execution vulnerabilities. However, the specific exploitation conditions and full impact remain unconfirmed pending the official disclosure.
Administrators should review the release details as they become available and prioritize patching internet-facing systems where applicable.
If you're unsure whether your website or applications may be affected, or need assistance reviewing your PHP environment and applying the necessary updates, reach out to the Anteris team. We're happy to help assess your exposure and determine the appropriate next steps.
Update: October 21, 2026 – Additional Findings & Mitigations
Additional information has emerged regarding the two critical PHP vulnerabilities announced yesterday.
Early security research suggests that nearly all PHP versions from PHP 5 onward may be affected, potentially exposing a wide range of websites and applications. Official upstream security patches are expected to be limited to PHP 8.2 and newer.
The PHP Security Team has not yet officially confirmed the affected versions or released the full technical details.
We have already begun observing what appear to be exploitation attempts against websites, including smaller, lower-profile sites. This is an important reminder that attackers do not exclusively target large organizations. Automated attacks can affect websites of any size, regardless of their visibility or industry.
While we await the official security patches, administrators may be able to reduce exposure through the following temporary measures:
1. Disable PHP Session Upload Progress
Researchers have identified PHP's session upload progress functionality as a potential exploitation path. Administrators should consider disabling this feature to eliminate one exploitation path:
session.upload_progress.enabled = Off
With this setting off:
PHP does not track file upload progress in the $_SESSION variable.
Applications cannot use PHP's built-in session-based tracking to display upload percentages.
File uploads still work normally. This setting does not prevent users from uploading files.
2. Restrict Multipart and POST Requests
Administrators should consider temporarily blocking multipart/form-data requests before they are processed by PHP, using NGINX, another web server, or a web application firewall (WAF).
For applications that do not require POST requests, temporarily blocking those requests entirely may provide additional protection.
Important: These restrictions may temporarily interfere with legitimate website functionality, including form submissions, authentication, and file uploads. However, given the severity of these vulnerabilities and the potential consequences of exploitation, a temporary disruption is worth the additional protection.
If patching or implementing these mitigations is not immediately possible, we strongly recommend temporarily disconnecting affected systems from the public internet until they can be properly secured. This is particularly important for internet-facing systems, where continued exposure may present a significant security risk.
These measures are precautionary and have not yet been confirmed to fully mitigate either vulnerability. They should not be considered replacements for installing the official security patches.
Security updates remain scheduled for release today, October 21, at 14:00 UTC (10:00 AM Eastern).
We recommend that administrators review the official advisories once published and prioritize patching affected systems immediately.
For assistance reviewing your environment or implementing appropriate mitigations, please contact Anteris.