The PHP Security team announced an upcoming security release that fixes two critical vulnerabilities. It is scheduled for Wednesday, October 21, 2026 at 2:00 p.m. UTC (10:00 a.m. Eastern).
Both vulnerabilities are rated 9.2 under CVSS v4.0. The team has not yet indicated what the vulnerabilities are or which versions of PHP they affect. From the announcement:
All PHP users are encouraged to prepare now so that you can upgrade as soon as the release is available.
We reserve the right to publish sooner if details of a vulnerability become public or if evidence of active exploitation appears in the wild.
The Laravel team announced that Forge and Cloud will also be updated with a fix to a second node.js security issue:
Both the PHP and Node.js teams announced security releases for Wednesday, October 21st. The PHP one is scheduled for 2:00 p.m. UTC and Node.js has not yet confirmed a time.
We are working directly with the PHP Foundation and closely monitoring the Node.js release in order to integrate patched versions into our base images as quickly as possible. You may need to redeploy your applications to recover the patched images, but we are also investigating a way to silently patch applications without redeployment. We will email you again as soon as the updated images are online.
Affected versions, fixed versions and full details will be published with the release. We’ll share more once patched versions are available.
Gn tech
