Today's PHP Security Release, and How We're Strengthening PHP Security
- ID
- 37986
- Status
- summarized
- Published
- 22 Oct 2026, 2:41 AM
- Fetched
- 22 Oct 2026, 3:09 AM
- Provider
- Simon Willison
- Category
- developer-ai
- Original URL
- https://simonwillison.net/2026/Oct/21/php-security-release/
- Source URL
- https://simonwillison.net/atom/everything/
Summary
- Score
- 8.0
- Created
- 22 Oct 2026, 3:09 AM
- Tags
- Audience
- developersvibe_coderssaas_founders
What happened
PHP released patches across the entire 8.x line on October 21, 2026, fixing two remote code execution holes that had exploits circulating since the previous night. The early leak happened because CVE IDs spread on forums around 15:00 UTC on October 20 with a wrong release time and an inflated CVSS of 10.0 (actual 9.2), so PHP moved its pre-announcement to 19:30 UTC and pulled the release forward from October 22 to October 21 at 14:00 UTC. Wiz Research's timeline says it found the first flaw on August 19, 2026, confirmed unauthenticated RCE against Drupal on August 20 and WordPress on August 21, reported to PHP on August 24, and PHP began the coordinated fix on September 21; a security firm's mistakenly published PoC video around 20:00 UTC on October 20 accelerated public exploit development.
Why it matters
If you run PHP 8.x — including WordPress or Drupal sites — upgrade to the October 21 patch now: these are unauthenticated RCEs with public exploits already circulating, and the intended October 22 release date no longer applies. The leak also compressed the disclosure window, so treat this as an already-exploited bug rather than a patch-day formality.
Discussion angle
The coordinated disclosure broke down: wrong CVE details spread first, then a vendor's PoC video leaked, accelerating exploit development — what does that imply for how fast you need to patch when a disclosure slips, and does AI-assisted vulnerability discovery (Wiz cites Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol) mean shorter windows between discovery and public exploit?