Today's PHP Security Release, and How We're Strengthening PHP Security

Today's PHP 8.x releases fix two remote code execution vulnerabilities, and exploits have been circulating since last night after CVE IDs leaked on forums and social media on October 20 with a wrong release time and an incorrect CVSS score of 10.0 (the actual score is 9.2). The PHP project moved its pre-announcement to 19:30 UTC and the release from October 22 to October 21 at 14:00 UTC, and a security firm mistakenly published a proof-of-concept video that accelerated PoC development. Wiz Research reports discovering the first vulnerability on August 19, 2026, confirming unauthenticated RCE against Drupal and WordPress, and reporting to the PHP security team on August 24.