According to a link post by Simon Willison published on 21st October 2026, the PHP project released security updates across the entire PHP 8.x line addressing two remote code execution vulnerabilities. Willison writes that exploits had been circulating since the previous night due to a leak in the coordinated disclosure process, and that anyone running PHP should upgrade.
Citing a post from the PHP Foundation, the account states that on Tuesday, October 20th at around 15:00 UTC, two CVE IDs began circulating on online forums and social media. They appeared with an incorrect release time and an incorrect CVSS score of 10.0 (the actual score is 9.2), though no technical details leaked at that point. In response, the PHP project brought its pre-announcement forward to 19:30 UTC and moved the release from October 22nd at 14:00 UTC to October 21st at 14:00 UTC.
The account further states that around 20:00 UTC, Calif, one of the security firms that reported the issues, mistakenly published a video showing a proof of concept working against several targets and revealing limited additional details. Copies of the deleted video circulated on social media, contributing to accelerated development of exploitation proof-of-concepts and increased circulation on October 21st.
- Updates span the entire PHP 8.x line and address two remote code execution vulnerabilities
- Actual CVSS score is 9.2; a leaked score of 10.0 was incorrect
- The release was moved up one day, to October 21st at 14:00 UTC, after a disclosure leak
- Exploit proof-of-concepts were reportedly circulating before the official release
What it means for you
If any system your organization runs is built on PHP — many websites, e-commerce platforms and content systems are — there are two serious flaws that let an attacker run code on your server, and working attack code is already circulating in the wild. This is the rare security item where speed genuinely matters, because the usual quiet window between a fix being published and attackers figuring it out was lost to a leak.
Try this
This week, find out whether anything you run uses PHP (ask whoever maintains your website or hosting), confirm which version, and get it patched to the latest 8.x release. If a vendor or hosting provider manages it for you, ask them directly whether they've applied the update.
Who should care
Whoever owns or maintains your website, e-commerce store, or any self-hosted web application, and anyone on managed hosting running PHP-based software like WordPress, Drupal or Magento.
Skip this if
You run nothing on PHP, or your web systems are fully managed by a provider who has already confirmed the patch is applied.
Sources: Simon Willison — read the original