PHP releases security update fixing two RCE vulnerabilities
What happened
On 22 October 2026, Simon Willison reported that the full PHP 8.x line has released a security update fixing two remote code execution vulnerabilities. According to the report, exploit code has been circulating since the evening of 21 October because of a leak in the coordinated disclosure process. Public reporting so far covers only the release of the update and the leak, and does not mention the specific range of affected versions, vulnerability identifiers or fix details.
Written by AI from the reports · updated 58 min ago
Timeline
Follow the reports to see the event from each side.
- Simon WillisonToday's PHP Security Release, and How We're Strengthening PHP Security
Today's PHP Security Release, and How We're Strengthening PHP Security If you're running anything on PHP it's vital you upgrade - today's updates (across the entire PHP 8.x line) address two remote code execution holes, and there have been exploits circulating since last night, thanks to a leak in the coordinated disclosure process.
Heat of this event
Not enough continuous observations yet to draw a trend.