PHP warns admins of two critical flaws, emergency patches coming tomorrow

[alimac]

The PHP security team is warning administrators to prepare for emergency security updates tomorrow to address two critical vulnerabilities, as information about the flaws has reportedly leaked ahead of their scheduled disclosure.
PHP powers many websites and web applications, including content management systems, e-commerce platforms, and custom web services.
In an advisory published Tuesday, the PHP development team announced that it plans to release security updates on Wednesday, October 21, at 14:00 UTC (10:00 AM Eastern), to address two vulnerabilities, each rated 9.2 under CVSS v4.0.

PHP warns admins of two critical flaws, emergency patches coming tomorrow

More
https://www.reuters.com/world/asia-...aken-offline-php-prepares-patches-2026-10-21/

 

[alimac]

PHP has warned of another way an attacker could run code on a web server, two days after it shipped emergency fixes for the critical PHP2Shell flaws.

The new issue, assigned CVE-2026-115560, affects only web applications configured in an unusual way, and PHP considers it an unlikely risk. The project is not issuing an emergency fix for it. Instead, it recommends turning off a feature called session upload progress until a fix is available in the next routine release.

https://thehackernews.com/2026/10/urgent-php-warns-of-another-unpatched.html