A forthcoming PHP update will patch two vulnerabilities classified as critical under the Common Vulnerability Scoring System version 4.0, each carrying a severity rating of 9.2. The update is slated for release on Wednesday, 21 October 2026, at 14:00 UTC. The PHP development team has advised users to prepare for the patch and apply updates promptly upon availability. The team retains the option to accelerate the release if technical details of either flaw become public or if evidence emerges of active exploitation in real-world environments. The announcement was issued by the PHP security team.