Today's PHP Security Release, and How We're Strengthening PHP Security

On October 21, 2026, the PHP Foundation released security patches for PHP 8.x to fix two remote code execution vulnerabilities. The fixes came after a premature leak and exploit videos circulated online, accelerating proof-of-concept development. The vulnerabilities were initially discovered by Wiz Research in August 2026 and responsibly reported to PHP in late August.