Wednesday, October 21, 2026 · 1 of 5

1. PHP will ship an out-of-cycle fix at 14:00 UTC today for two critical RCE flaws

   Both CVSS 9.2 on v4.0, after details leaked ahead of the embargo. Clear a patch window now.

   Oct 21Security