PHP will release an emergency security update today, October 21, at 14:00 UTC to address two critical remote code execution vulnerabilities rated 9.2 on the CVSS v4.0 scale. The PHP security team has not disclosed technical details about the flaws.
Security researchers at watchTowr identified the vulnerabilities and confirmed both allow remote code execution. The flaws affect PHP versions 8.2 through 8.5, the four currently supported branches. Only these versions will receive patches through the out-of-cycle release.
No active exploitation has been reported at the time of the alert. The decision to issue an emergency update outside the normal release schedule reflects the severity rating and the broad attack surface presented by PHP's widespread deployment.
PHP maintainers restricted the fix to supported branches, meaning users running older versions will not receive patches for these vulnerabilities. Organizations using PHP 8.2, 8.3, 8.4, or 8.5 should apply the emergency update immediately upon release.
The withholding of technical details ahead of the patch release follows standard coordinated disclosure practices designed to limit the window during which attackers could develop functional exploits. watchTowr's identification of the flaws demonstrates ongoing security research into the PHP codebase, even as the language maintains a large installed base across web infrastructure.
The timing and severity of the emergency release indicate the PHP security team prioritized rapid patch development and deployment over the normal release cadence, underscoring the risk these vulnerabilities pose to systems running affected versions.