The PHP security team has issued advance notice of an upcoming critical security release, scheduled for Wednesday, October 21, 2026 at 14:00 UTC (10:00 AM Eastern).
The release fixes two critical vulnerabilities, both rated 9.2 on the CVSS v4.0 scale.
PHP is the programming language WordPress is built on. Every WordPress site runs on a server with PHP installed, which means this release is relevant to every WordPress site owner, regardless of which plugins or themes they use.
The PHP team has not yet shared which versions are affected, what the vulnerabilities are, or which versions will contain the fix.
Click here to continue reading this article.
