PHP's security team has scheduled a release for October 21, 2026, at 14:00 UTC to address two critical vulnerabilities, each rated CVSS v4.0 9.2. Its October 20 advance notice asks all PHP users to prepare to upgrade as soon as the release is available.
For teams running PHP applications, the immediate job is to get their update process ready. The notice leaves affected and fixed versions for the release announcement. Until that arrives, operators don't have a confirmed version checklist for these flaws.
What the warning establishes
The security team says it may release earlier if vulnerability details become public or evidence of active exploitation appears. That is a condition for changing the schedule. The warning itself does not report an observed attack.
The same notice promises full details with the release. It doesn't describe an attack path or identify a configuration that avoids the vulnerabilities, so it provides no basis for a configuration-specific workaround. Preparation can begin now, while decisions about exposure need the advisory's missing details.
Check which PHP runtime serves the application
A useful starting point for an inventory is PHP's documented version command:
php -v
The manual's example shows both the PHP version and the interface name, such as cli. This command reports the PHP executable you invoke. Treat it as one inventory entry rather than proof of the version serving every website on the machine.
PHP's interface documentation distinguishes command-line PHP from web-server interfaces, including fpm-fcgi and apache2handler. For a web application, check the runtime attached to that service as well. In a container deployment, make the inventory at the application container, where an update would need to land.
That gives the team's request to prepare a practical shape: establish how each deployed runtime receives updates and who can roll them out. The affected-version list will determine which entries need action. The advance notice alone cannot settle that list.
Watch the official announcement for the affected branches and fixed release numbers, and check whether the schedule moves forward. Those details will turn today's preparation into a specific patch decision. Until then, the team has set a release time and asked users to be ready, without identifying which installations are exposed.