Update October 21, 2026: PHP has new releases to Fix Two Critical RCE Vulnerabilities
The PHP security team has announced an upcoming security release that fixes two critical vulnerabilities. It is scheduled for Wednesday, October 21, 2026 at 14:00 UTC (10:00 AM Eastern).
Both vulnerabilities are rated 9.2 under CVSS v4.0. The team has not shared what the vulnerabilities are or which PHP versions they affect yet. From the announcement:
All PHP users are encouraged to prepare now so they can upgrade as soon as the release is available.
We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild.
The Laravel team announced both Forge and Cloud will be updated as well with a fix to a second node.js security issue:
The PHP and Node.js teams have both announced security releases for Wednesday, October 21. PHP's is scheduled for 14:00 UTC, and Node.js hasn't confirmed a time yet.
We're working directly with the PHP Foundation, and closely tracking the Node.js release, to get patched versions into our base images as quickly as possible. You may need to redeploy your apps to pick up the patched images, but we're also exploring a way to silently patch applications without a redeployment. We'll email you again as soon as the updated images are live.
The affected versions, the fixed versions, and the full details will be published with the release. We will share more once the patched releases are out.
