PHP is preparing fixes for two critical vulnerabilities rated CVSS 9.2. The release is scheduled for October 21, 2026, at 14:00 UTC, or 17:00 Kyiv time. At 12:09 UTC it had not been announced; affected and fixed versions remain undisclosed. The notice does not confirm a project breach or active attacks.
What website owners should check
The practical first step is to establish who handles PHP updates. On managed hosting, that may be the provider; on a self-managed server, it will usually be the administrator.
Website owners need a concrete answer: which version serves their domain, who will install the fix, and how completion will be confirmed. A new release appearing on the developers’ website does not mean that a hosting provider has automatically installed it.
Check the version used by the live website, rather than relying only on information about the control panel. If an account hosts several projects, ask about each one. There is no need to expose diagnostic pages to every visitor or publish server settings to do this check. A protected management panel or an answer from technical support is sufficient.
Preparing for the update
The following is a general editorial checklist, not a specific mitigation for the as-yet undisclosed issues.
- Check that a recent backup covers both website files and the database, and that there is a clear restoration procedure.
- Agree an installation window with the hosting provider and establish how completion will be communicated.
- Check compatibility of the CMS, extensions and custom code with the proposed version. Where possible, test the update on a staging copy first.
- Prepare a short list of important workflows: signing in, submitting a form, searching, using the basket and completing checkout, where applicable.
Avoid changing the theme, plugin selection and other components at the same time without a reason. Combining unrelated changes makes it harder to identify the cause of a problem. A backup can help recovery after a failure, but it does not close a vulnerability. Compatibility checks should support installation, rather than become a reason to postpone it indefinitely.
After installation
Ask the administrator to confirm the installed version or security package, then run the checks prepared for the website. If the hosting provider performs the work, keep its confirmation. A working homepage alone does not establish that the fix has been applied: availability and successful patch installation are different checks.
The official PHP manual recommends regular updates and awareness of release changes. Its separate lifecycle table shows whether a branch still receives support; it is not a list of versions affected by a particular vulnerability. An unsupported environment needs a migration plan agreed with its administrator, rather than an assumption that the next security fix will also be released for it.
Comments