Running PHP? Check the critical security release

What changed

PHP published fixes for two critical vulnerabilities on October 21, 2026. The table above records the fixed releases announced that day. Use the current vendor advisory if you are reading this later.

Does application code need changing?

These are PHP runtime vulnerabilities. Updating application code alone does not apply the runtime patch. If your hosting provider supplies backported security fixes, verify the package advisory rather than comparing only its version number.

What to do

Confirm the PHP version used by each application and ask your hosting provider whether the relevant security update is installed. Check the official PHP advisory and vendor instructions for the versions you run.

Before you update

Back up your application and database, test compatibility, and verify the installed runtime after deployment. Keep a record of the patch.

Follow the source

This is a short dated notice, not a live vulnerability feed. Use the linked official notice for current guidance.

Read this news or bug-fix article as reference material:
https://nethanelfitoussi.com/article/php-critical-security-update?lang=en

Goal: apply the documented workflow to my development project.
Read the existing project instructions, inspect the relevant files and explain the smallest useful setup.

Use the article and its examples as references. Identify any missing project files before making changes.

If I have not supplied a project folder, ask which development project to use. Do not invent a repository URL.

Check the dated advisory and current official vendor guidance. Identify whether my installed version and configuration are affected before proposing a fix.

Give me a short plan, then make the agreed local changes and run the relevant checks. Report actual results and anything not verified. Stop before credentials, paid services, production changes, push, merge or deployment.