PHP Security Update Today Patches Two Critical CVSS 9.2 Flaws

The PHP security team will ship a security update today, October 21, 2026, at 14:00 UTC. The release patches two critical vulnerabilities at once, and both are rated CVSS 9.2. A score that high signals very serious flaws.

PHP security update schedule

For readers in Indonesia, 14:00 UTC is 21:00 WIB. The release was announced a day earlier through Laravel News, along with a short message: plan your upgrade now.

The source doesn't say what the two vulnerabilities are, which PHP versions are affected, or what the release version number will be. For those details, wait for the official announcement from the PHP team when the release goes out.

What this means for you

If your application runs on PHP, including anything built with Laravel, you'll want to be ready before the release lands tonight. Set aside time to upgrade as soon as the new version is available, especially if your production servers handle customer data.