PHP warns of two critical flaws, patches due Wednesday

The PHP security team is warning administrators to prepare for emergency security updates tomorrow to address two critical vulnerabilities, as information about the flaws has reportedly leaked ahead of their scheduled disclosure. The updates are scheduled for Wednesday, October 21, at 14:00 UTC, addressing two vulnerabilities rated 9.2 under CVSS v4.0. Security researchers at watchTowr claim the flaws are remote code execution vulnerabilities affecting PHP versions 5, 6, 7, and 8. The PHP team reserves the right to release earlier if details become public or active exploitation appears. No technical details have been officially disclosed, and no exploitation has been observed in the wild.